Description
OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | 1:9.8p1-1 | — |
| Debian 13 | openssh | 1:9.8p1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | openssh | 1:9.6p1-3ubuntu13.4 | USN-6887-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | openssh +1 | 9.6p1-150600.6.6.1 | SUSE-SU-2024:2393-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.0 | openssh | 9.6p1-2.1 | SUSE-SU-2025:20009-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssh | 9.6p1-11.1 | openSUSE-SU-2024:14113-1 |
| openSUSE Leap 15.6 | openssh +1 | 9.6p1-150600.6.6.1 | SUSE-SU-2024:2393-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | openssh | 9.8p1-1 | — |
Advisories 8
- WID-SEC-2024-1514 OpenSSH: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Jun 2, 2026
- SUSE-SU-2025:20009-1 Security update for openssh SUSE / openSUSE Security Updates · Mar 23, 2026
- USN-6887-1 openssh vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:14113-1 openssh-9.6p1-11.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2393-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- VDE-2024-071 Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware CERT@VDE · May 22, 2025
- WID-SEC-2024-2154 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 11, 2025
- NCSC-2024-0381 Kwetsbaarheden verholpen in Apple MacOS NCSC-NL (Netherlands) · Sep 26, 2024
References
- https://www.openssh.com/txt/release-9.8
- https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html
- https://www.openwall.com/lists/oss-security/2024/07/02/1
- [oss-security] 20240703 Re: Announce: OpenSSH 9.8 released mailing-list
- https://security.netapp.com/advisory/ntap-20240712-0004/
- [oss-security] 20240723 Re: linux-distros application for CentOS Project's Hyperscale SIG mailing-list
- [oss-security] 20240723 Re: linux-distros application for CentOS Project's Hyperscale SIG mailing-list
- [oss-security] 20240728 Re: Announce: OpenSSH 9.8 released mailing-list
- https://crzphil.github.io/posts/ssh-obfuscation-bypass/
- https://news.ycombinator.com/item?id=41508530