K57304814 : OpenSSH vulnerability CVE-2016-8858

Security Advisory Description

DISPUTED The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests. NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue. (CVE-2016-8858)
Impact
An unauthenticated, remote attacker can exploit this, by sending multiple KEXINIT messages, to consume up to 128 MB per connection. The LineRate system default MaxSessions option in thesshd_configconfiguration file is10, which limits the impact of this vulnerability to approximately 1 GB of memory consumed. This vulnerability should only be a concern for very small LineRate deployments.