Description
OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | 1:8.1p1-1 | — |
| Debian 13 | openssh | 1:8.1p1-1 | — |
| Debian 12 | openssh | 1:8.1p1-1 | — |
Advisories 5
- SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
- ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
- WID-SEC-2023-0998 OpenSSH: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten BSI CERT-Bund (WID) · Apr 16, 2024
- ICSA-22-349-21 Siemens SCALANCE X-200RNA Switch Devices CISA ICS & IT advisories · Dec 13, 2022
- SSA-412672 SSA-412672: Multiple OpenSSL and OpenSSH Vulnerabilities in SCALANCE X-200RNA Switch Devices before V3.2.7 Siemens ProductCERT · Dec 13, 2022
References
- https://www.openssh.com/releasenotes.html
- https://www.openwall.com/lists/oss-security/2019/10/09/1
- https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c.diff?r1=1.5&r2=1.6&f=h
- https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c
- https://bugzilla.suse.com/show_bug.cgi?id=1153537
- https://ssd-disclosure.com/archives/4033/ssd-advisory-openssh-pre-auth-xmss-integer-overflow
- https://security.netapp.com/advisory/ntap-20191024-0003/
- GLSA-201911-01 vendor-advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf