Description
OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | No fix yet | — |
| Debian 13 | openssh | No fix yet | — |
| Debian 12 | openssh | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | openssh | 9.5p1-2 | — |
| Azure Linux 2 (CBL-Mariner) | openssh | 8.8p1-2 | — |
Advisories 2
- SCA-2025-0011 Vulnerabilities affecting Endress+Hauser SSG-E210GC SICK PSIRT · Oct 2, 2025
- SCA-2025-0009 Vulnerabilities affecting SICK TDC-E210GC SICK PSIRT · Aug 1, 2025