New OpenSSH Flaws Enable Man-in-the
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-6387 | A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. NVD description · AI analysis pending | 8.1 | 100% | PoC ×7 |
| — | |
| CVE-2025-26465 | A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high. NVD description · AI analysis pending | 6.8 | 8% |
| — | ||
| CVE-2025-26466 | Unauthenticated Memory-Exhaustion DoS in OpenSSH CVE-2025-26466 is a denial-of-service flaw in the OpenSSH server: for every ping packet the SSH server receives, it allocates a corresponding pong packet in a memory buffer and adds it to a queue, and that memory is only freed once the server/client key exchange completes. A remote, unauthenticated attacker can hold a connection open and keep flooding it with ping packets faster than the key exchange finishes, driving uncontrolled memory growth until the SSH server becomes unavailable. The impact is availability-only, with no code execution or data exposure (CVSS 3.1 score 5.9, network vector with high attack complexity). Any system running an affected OpenSSH build is exposed, notably as packaged in Ubuntu Linux and Debian Linux, with internet-facing SSH endpoints the most attractive targets. No public PoC or confirmed in-the-wild exploitation is known and it is not in CISA KEV, but EPSS of ~40% (99th percentile) signals an elevated probability of exploitation within 30 days; the related headlines describing critical OpenSSH flaws also cover companion issues (including a man-in-the-middle bug) from the same disclosure. Do: Install the OpenSSH security updates released by Canonical and Debian in February 2025 (upstream fix in OpenSSH 9.9p2) and verify the running version with 'ssh -V' or your package manager. Until patched, reduce exposure by restricting SSH to trusted sources via firewall allowlists and rate-limiting unauthenticated connections (e.g., MaxStartups or fail2ban), and monitor sshd memory usage for abnormal growth. | 5.9 | 40% |
| mass~10-20 million internet-exposed SSH endpoints, with potentially millions of unpatched Ubuntu/Debian servers among them |
Full article360 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananFeb 18, 2025Vulnerability / Network Security
Two security vulnerabilities have been discovered in the OpenSSH secure networking utility suite that, if successfully exploited, could result in an active machine-in-the-middle (MitM) and a denial-of-service (DoS) attack, respectively, under certain conditions.
The vulnerabilities, detailed by the Qualys Threat Research Unit (TRU), are listed below -
- CVE-2025-26465 (CVSS score: 6.8) - The OpenSSH client contains a logic error between versions 6.8p1 to 9.9p1 (inclusive) that makes it vulnerable to an active MitM attack if the VerifyHostKeyDNS option is enabled, allowing a malicious interloper to impersonate a legitimate server when a client attempts to connect to it (Introduced in December 2014)
- CVE-2025-26466 (CVSS score: 5.9) - The OpenSSH client and server are vulnerable to a pre-authentication DoS attack between versions 9.5p1 to 9.9p1 (inclusive) that causes memory and CPU consumption (Introduced in August 2023)
"If an attacker can perform a man-in-the-middle attack via CVE-2025-26465, the client may accept the attacker's key instead of the legitimate server's key," Saeed Abbasi, manager of product at Qualys TRU, said.
"This would break the integrity of the SSH connection, enabling potential interception or tampering with the session before the user even realizes it."
In other words, a successful exploitation could permit malicious actors to compromise and hijack SSH sessions, and gain unauthorized access to sensitive data. It's worth noting that the VerifyHostKeyDNS option is disabled by default.
That said, the option was enabled by default on FreeBSD from September 2013 until March 2023, thereby potentially exposing machines running the Unix-like operating system to potential risks.
Repeated exploitation of CVE-2025-26466, on the other hand, can result in availability issues, preventing administrators from managing servers and locking legitimate users out, effectively crippling routine operations.
Both the vulnerabilities have been addressed in version OpenSSH 9.9p2 released today by OpenSSH maintainers.
The disclosure comes over seven months after Qualys shed light on another OpenSSH flaw dubbed regreSSHion (CVE-2024-6387, CVSS score: 8.1) that could have resulted in unauthenticated remote code execution with root privileges in glibc-based Linux systems.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/02/new-openssh-flaws-enable-man-in-middle.html