Lucene search

K
freebsdFreeBSD09B7CD39-47BD-11EE-8E38-002590C1F29C
HistoryFeb 16, 2023 - 12:00 a.m.

FreeBSD -- OpenSSH pre-authentication double free

2023-02-1600:00:00
vuxml.freebsd.org
19
freebsd
openssh
double free
denial of service
remote code execution

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

0.009 Low

EPSS

Percentile

82.6%

Problem Description:
A flaw in the backwards-compatibility key exchange route allows a
pointer to be freed twice.
Impact:
A remote, unauthenticated attacker may be able to cause a denial of
service, or possibly remote code execution.
Note that FreeBSD 12.3 and FreeBSD 13.1 include older versions of
OpenSSH, and are not affected. FreeBSD 13.2-BETA1 and later include the
fix.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchfreebsd= 12.4UNKNOWN
FreeBSDanynoarchfreebsd< 12.4_2UNKNOWN

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

0.009 Low

EPSS

Percentile

82.6%