Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-8xuk-wu5f-6ygy
Vulnerability ID VCID-8xuk-wu5f-6ygy
Aliases CVE-2012-0814
Summary The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command options, which allows remote authenticated users to obtain potentially sensitive information by reading these messages, as demonstrated by the shared user account required by Gitolite. NOTE: this can cross privilege boundaries because a user account may intentionally have no shell or filesystem access, and therefore may have no supported way to read an authorized_keys file in its own home directory.
Status Published
Exploitability 0.5
Weighted Severity 5.9
Risk 3.0
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv3.1 6.5 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=657445
ssvc Track http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=657445
cvssv3.1 6.5 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673
ssvc Track http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673
cvssv3.1 6.5 http://openwall.com/lists/oss-security/2012/01/26/15
ssvc Track http://openwall.com/lists/oss-security/2012/01/26/15
cvssv3.1 6.5 http://openwall.com/lists/oss-security/2012/01/26/16
ssvc Track http://openwall.com/lists/oss-security/2012/01/26/16
cvssv3.1 6.5 http://openwall.com/lists/oss-security/2012/01/27/1
ssvc Track http://openwall.com/lists/oss-security/2012/01/27/1
cvssv3.1 6.5 http://openwall.com/lists/oss-security/2012/01/27/4
ssvc Track http://openwall.com/lists/oss-security/2012/01/27/4
cvssv3.1 6.5 http://osvdb.org/78706
ssvc Track http://osvdb.org/78706
epss 0.00268 https://api.first.org/data/v1/epss?cve=CVE-2012-0814
epss 0.00268 https://api.first.org/data/v1/epss?cve=CVE-2012-0814
epss 0.00275 https://api.first.org/data/v1/epss?cve=CVE-2012-0814
cvssv3.1 6.5 https://exchange.xforce.ibmcloud.com/vulnerabilities/72756
ssvc Track https://exchange.xforce.ibmcloud.com/vulnerabilities/72756
cvssv3.1 6.5 http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c
ssvc Track http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c
cvssv3.1 6.5 http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c.diff?r1=1.53%3Br2=1.54
ssvc Track http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c.diff?r1=1.53%3Br2=1.54
cvssv3.1 6.5 http://www.securityfocus.com/bid/51702
ssvc Track http://www.securityfocus.com/bid/51702
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-0814.json
https://api.first.org/data/v1/epss?cve=CVE-2012-0814
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0814
1 http://openwall.com/lists/oss-security/2012/01/27/1
15 http://openwall.com/lists/oss-security/2012/01/26/15
16 http://openwall.com/lists/oss-security/2012/01/26/16
4 http://openwall.com/lists/oss-security/2012/01/27/4
51702 http://www.securityfocus.com/bid/51702
657445 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=657445
72756 https://exchange.xforce.ibmcloud.com/vulnerabilities/72756
785292 https://bugzilla.redhat.com/show_bug.cgi?id=785292
78706 http://osvdb.org/78706
auth-options.c http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c
auth-options.c.diff?r1=1.53%3Br2=1.54 http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c.diff?r1=1.53%3Br2=1.54
bugreport.cgi?bug=657445 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=657445
GLSA-201405-06 https://security.gentoo.org/glsa/201405-06
index?page=content&id=JSA10673 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=657445
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-22T10:26:37Z/ Found at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=657445
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-22T10:26:37Z/ Found at http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at http://openwall.com/lists/oss-security/2012/01/26/15
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-22T10:26:37Z/ Found at http://openwall.com/lists/oss-security/2012/01/26/15
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at http://openwall.com/lists/oss-security/2012/01/26/16
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-22T10:26:37Z/ Found at http://openwall.com/lists/oss-security/2012/01/26/16
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at http://openwall.com/lists/oss-security/2012/01/27/1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-22T10:26:37Z/ Found at http://openwall.com/lists/oss-security/2012/01/27/1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at http://openwall.com/lists/oss-security/2012/01/27/4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-22T10:26:37Z/ Found at http://openwall.com/lists/oss-security/2012/01/27/4
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at http://osvdb.org/78706
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-22T10:26:37Z/ Found at http://osvdb.org/78706
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://exchange.xforce.ibmcloud.com/vulnerabilities/72756
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-22T10:26:37Z/ Found at https://exchange.xforce.ibmcloud.com/vulnerabilities/72756
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-22T10:26:37Z/ Found at http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c.diff?r1=1.53%3Br2=1.54
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-22T10:26:37Z/ Found at http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c.diff?r1=1.53%3Br2=1.54
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at http://www.securityfocus.com/bid/51702
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-22T10:26:37Z/ Found at http://www.securityfocus.com/bid/51702
Exploit Prediction Scoring System (EPSS)
Percentile 0.50694
EPSS Score 0.00268
Published At June 12, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:55:57.532833+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2012/0xxx/CVE-2012-0814.json 38.6.0