SSH Communications Security Information for VU#978316

Vulnerability in OpenSSH daemon (sshd)


Not Affected

Vendor Statement

Since 3.0.0, SSH Secure Shell server has had an additional specifier for matching with the host addresses, which can be used to only match IP-addresses or IP-masks. For example, one could specify

AllowUsers *@\i192.168.*.*

Since 3.1.0, a specifier for address masks was added.

AllowUsers *@\m192.168.0.0/16

The specifiers are to be prepended to the address, and are "\i" and "\m", respectively.

Thus, SSH Secure Shell daemon is not vulnerable to this, if these specifiers are used.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Vendor References



The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.