CVE-2014-1692

HIGH 7.3CVE-2014-1692 · Published 29/01/2014 · updated 17/06/2026

In short

CVE-2014-1692 is a HIGH (CVSS 7.3) vulnerability affecting openssh (openbsd).
Chance of exploitation in the next 30 days (EPSS): 4.7%, higher than 91.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
openssh openbsd	`≤ 6.4`	No fix yet

Description

The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition.

References

marc.info · Third Party Advisory
marc.info · Third Party Advisory
openwall.com/lists/oss-security/2014/01/29/10 · Mailing List
openwall.com/lists/oss-security/2014/01/29/2 · Mailing List
osvdb.org/102611 · Broken Link
secunia.com/advisories/60184 · Third Party Advisory
www-01.ibm.com/support/docview.wss · Third Party Advisory
openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/Attic/schnorr.c.diff
openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/schnorr.c · Vendor Advisory
securityfocus.com/bid/65230 · Third Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/90819 · Third Party Advisory

More vulnerabilities in openssh

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

openssh

openbsd

≤ 6.4

No fix yet

Description

More vulnerabilities in openssh

See all →