CVE-2019-16905

HIGH

OpenSSH 7.7-7.9 and 8.x < 8.1 - Unauthenticated Remote Code Execution via XMSS Key Parsing Integer Overflow

Title source: llm
STIX 2.1

Description

OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH.

References (9)

Core 9
Core References
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/201911-01
Issue Tracking, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1153537

Scores

CVSS v3 7.8
EPSS 0.0027
EPSS Percentile 50.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-190
Status published
Products (5)
netapp/cloud_backup
netapp/steelstore_cloud_integrated_storage
openbsd/openssh 7.7 - 7.9
siemens/scalance_x204rna_ecc_firmware < 3.2.7
siemens/scalance_x204rna_firmware < 3.2.7
Published Oct 09, 2019
Tracked Since Feb 18, 2026