CVE-2016-8858

Description

References

• cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/kex.c.diff · Issue Tracking
• cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/kex.c · Issue Tracking
• openwall.com/lists/oss-security/2016/10/19/3 · Mailing List
• openwall.com/lists/oss-security/2016/10/20/1 · Mailing List
• securityfocus.com/bid/93776 · Third Party Advisory
• securitytracker.com/id/1037057 · Third Party Advisory
• bugzilla.redhat.com/show_bug.cgi · Issue Tracking
• cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
• ftp.openbsd.org/pub/OpenBSD/patches/6.0/common/013_ssh_kexinit.patch.sig · Patch
• openssh/openssh-portable commit ec165c3 · Issue Tracking
• security.freebsd.org/advisories/FreeBSD-SA-16:33.openssh.asc

openssh 的其他漏洞

• CVE-2026-106583高危 7.8In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
• CVE-2026-106587低危 3.3In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean …
• CVE-2026-106586中危 4.3In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a …
• CVE-2026-106585中危 6.5In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly c…
• CVE-2026-106584低危 3.3In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can b…