CVE-2008-5161
- State
- Published
- Severity
- 3.7 Low
- Published
- Nov 19, 2008
- Updated
- May 28, 2026
- Reserved
- Nov 19, 2008
Description
Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.7 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-329 Generation of Predictable IV with CBC Mode
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://openssh.org/txt/cbc.adv
- 247186vendor-advisory
- 32319vdb-entry
- 33121third-party-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667
- 49872vdb-entry
- 33308third-party-advisory
- RHSA-2009:1287vendor-advisory
- http://www.cpni.gov.uk/Docs/Vulnerability_Advisory_SSH.txt
- 1021382vdb-entry
- https://kc.mcafee.com/corporate/index?page=content&id=SB10163
- 50036vdb-entry
- 32833third-party-advisory
- 36558third-party-advisory
- 50035vdb-entry
- http://www.ssh.com/company/news/article/953/
- 1021235vdb-entry
- 34857third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-503.htm
- http://support.attachmate.com/techdocs/2398.html
- http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/CPNI957037.html
- ADV-2008-3173vdb-entry
- 20081123 Revised: OpenSSH security advisory: cbc.advmailing-list
- openssh-sshtectia-cbc-info-disclosure(46620)vdb-entry
- 32740third-party-advisory
- ADV-2009-1135vdb-entry
- 32760third-party-advisory
- ADV-2009-3184vdb-entry
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- 1021236vdb-entry
- https://kc.mcafee.com/corporate/index?page=content&id=SB10106
- HPSBMA02447vendor-advisory
- http://isc.sans.org/diary.html?storyid=5366
- APPLE-SA-2009-11-09-1vendor-advisory
- ADV-2008-3409vdb-entry
- ADV-2008-3172vdb-entry
- oval:org.mitre.oval:def:11279vdb-entrysignature
- 20081121 OpenSSH security advisory: cbc.advmailing-list
- http://support.apple.com/kb/HT3937
- VU#958563third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.