Skip to content
Sign in
CVE-2016-62105.9Medium

CVE-2016-6210

Vendor not yet named

Fixed in RHEL 6/7, Debian 12/13 · Exploitation: public proof of concept (unverified)

ExploitationProof of concept public

Not in CISA KEV as of catalogue 2026.11.04 (4 Nov)

  1. In CISA KEV: not seen
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public7 public GitHub repositories (unverified), listed by PoC-in-GitHub25 Aug 2019
  5. Not established: not seen
88.9%probability of exploitation in the next 30 days
99th percentile
050100

Higher than 99% of scored CVEs

5.9MediumCVSS
LowMedium

DescriptionNVD

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.

Fix status by distribution

From each distribution’s security tracker. Distributions we did not check are not listed.

What changed

Debian status tracked since 6 Nov 2026. Red Hat status tracked since 6 Nov 2026.

  1. Seen in Debian’s tracker on 6 Nov: Debian 12 fixed Debian
  2. Seen in Debian’s tracker on 6 Nov: Debian 13 fixed Debian
  3. Red Hat’s tracker lists RHEL 5 as affected, with no fix released Red Hat
  4. PoC-in-GitHub lists 7 public GitHub repositories (unverified) PoC-in-GitHub
  5. Red Hat published RHSA-2017:2563 for RHEL 6 on 31 Aug 2017 (we saw it 6 Nov) Red Hat
  6. Red Hat published RHSA-2017:2029 for RHEL 7 on 1 Aug 2017 (we saw it 6 Nov) Red Hat

Coverage1 article · 1 outlet

First in our coverage: The Hacker News, 6 Nov.

  1. Hackers Exploit OpenSSH SSHole Flaw to Gain Root Access
    The Hacker News · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in