VulnerableCode Package Details - pkg:alpm/archlinux/openssh@8.8p1-1

Search for packages

Vulnerability	Summary	Fixed by
VCID-7rkw-a8y5-aaak Aliases: CVE-2016-20012	DISPUTED OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product.	8.9p1-1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-7rkw-a8y5-aaak
Aliases:
CVE-2016-20012

** DISPUTED ** OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product.

8.9p1-1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-a999-r8d4-aaad	sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.	CVE-2021-41617

Vulnerability

Summary

Aliases

VCID-a999-r8d4-aaad

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

CVE-2021-41617

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-03-28T07:47:02.009946+00:00	Arch Linux Importer	Affected by	VCID-7rkw-a8y5-aaak	https://security.archlinux.org/AVG-2392	36.0.0
2025-03-28T07:46:27.587423+00:00	Arch Linux Importer	Fixing	VCID-a999-r8d4-aaad	https://security.archlinux.org/AVG-2422	36.0.0
2024-09-18T02:02:24.481970+00:00	Arch Linux Importer	Affected by	VCID-7rkw-a8y5-aaak	https://security.archlinux.org/AVG-2392	34.0.1
2024-09-18T02:01:44.124657+00:00	Arch Linux Importer	Fixing	VCID-a999-r8d4-aaad	https://security.archlinux.org/AVG-2422	34.0.1
2024-01-03T22:28:25.829875+00:00	Arch Linux Importer	Affected by	VCID-7rkw-a8y5-aaak	https://security.archlinux.org/AVG-2392	34.0.0rc1
2024-01-03T22:27:49.723259+00:00	Arch Linux Importer	Fixing	VCID-a999-r8d4-aaad	https://security.archlinux.org/AVG-2422	34.0.0rc1