CVE-2023-25136

Description

References

• openwall.com/lists/oss-security/2023/02/13/1 · Mailing List
• openwall.com/lists/oss-security/2023/02/22/1 · Mailing List
• openwall.com/lists/oss-security/2023/02/22/2 · Mailing List
• openwall.com/lists/oss-security/2023/02/23/3 · Mailing List
• openwall.com/lists/oss-security/2023/03/06/1 · Mailing List
• openwall.com/lists/oss-security/2023/03/09/2 · Mailing List
• bugzilla.mindrot.org/show_bug.cgi · Exploit
• ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig · Patch
• openssh/openssh-portable commit 486c4dc · Patch
• jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept · Exploit

openssh 的其他漏洞

• CVE-2026-106583高危 7.8In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
• CVE-2026-106587低危 3.3In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean …
• CVE-2026-106586中危 4.3In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a …
• CVE-2026-106585中危 6.5In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly c…
• CVE-2026-106584低危 3.3In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can b…