OpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openssh: User enumeration via malformed packets in authentication requests (CVE-2018-15919)

  - openssh: authentication bypass via row hammer attack (CVE-2023-51767)

  - OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username     and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a     challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not     recognize user enumeration as a vulnerability for this product (CVE-2016-20012)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openssh: Public key information leak (CVE-2016-20012)

  - openssh: authentication bypass via row hammer attack (CVE-2023-51767)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

ID	Name	Product	Family	Severity
198948	RHEL 8 : openssh (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198870	RHEL 9 : openssh (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195419	RHEL 7 : openssh (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195377	RHEL 6 : openssh (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2023-51767

high

Tenable Plugins

high

high

high

high