CVE-2019-16905 (GCVE-0-2019-16905)

Vulnerability from cvelistv5 – Published: 2019-10-09 00:00 – Updated: 2025-04-23 15:45

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Assigner

mitre mitre root

References

9 references

URL	Tags
https://www.openssh.com/releasenotes.html
https://www.openwall.com/lists/oss-security/2019/…
https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr…
https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr…
https://bugzilla.suse.com/show_bug.cgi?id=1153537
https://ssd-disclosure.com/archives/4033/ssd-advi…
https://security.netapp.com/advisory/ntap-2019102…
https://security.gentoo.org/glsa/201911-01	vendor-advisory
https://cert-portal.siemens.com/productcert/pdf/s…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-04-23T15:45:01.432Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openssh.com/releasenotes.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2019/10/09/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c.diff?r1=1.5\u0026r2=1.6\u0026f=h"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1153537"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://ssd-disclosure.com/archives/4033/ssd-advisory-openssh-pre-auth-xmss-integer-overflow"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20191024-0003/"
          },
          {
            "name": "GLSA-201911-01",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201911-01"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-17T20:59:26.573Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openssh.com/releasenotes.html"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2019/10/09/1"
        },
        {
          "url": "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c.diff?r1=1.5\u0026r2=1.6\u0026f=h"
        },
        {
          "url": "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c"
        },
        {
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1153537"
        },
        {
          "url": "https://ssd-disclosure.com/archives/4033/ssd-advisory-openssh-pre-auth-xmss-integer-overflow"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20191024-0003/"
        },
        {
          "name": "GLSA-201911-01",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/201911-01"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-16905",
    "datePublished": "2019-10-09T00:00:00.000Z",
    "dateReserved": "2019-09-26T00:00:00.000Z",
    "dateUpdated": "2025-04-23T15:45:01.432Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2019-16905",
      "date": "2026-09-18",
      "epss": "0.0217",
      "percentile": "0.81456"
    },
    "microsoft_vex": {
      "current_release_date": "2020-09-25T00:00:00.000Z",
      "cve": "CVE-2019-16905",
      "id": "msrc_CVE-2019-16905",
      "initial_release_date": "2019-10-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "OpenSSH 7.7 through 7.9 and 8.x before 8.1 when compiled with an experimental key type has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions and there is no supported way to enable it when building portable OpenSSH.",
      "url": "https://msrc.microsoft.com/csaf/vex/2019/msrc_cve-2019-16905.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4419F9A7-C91A-49F3-8424-0FC679147627",
                    "versionEndIncluding": "7.9",
                    "versionStartIncluding": "7.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7EDB383B-BB44-4FEA-917B-1BA5279DB478",
                    "versionEndExcluding": "8.1",
                    "versionStartIncluding": "8.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5C2089EE-5D7F-47EC-8EA5-0F69790564C4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E94F7F59-1785-493F-91A7-5F5EA5E87E4D",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0D3A0312-1249-4257-98F1-57E8959989C5",
                    "versionEndExcluding": "3.2.7",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EA8B483F-0FD2-49F8-A86A-672A6E007949",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:siemens:scalance_x204rna_ecc_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0F4927F0-F350-431B-9762-009DC7660588",
                    "versionEndExcluding": "3.2.7",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:siemens:scalance_x204rna_ecc:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "230B1F1A-8D69-4C66-8046-7D1DE3BEFEA1",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH."
          },
          {
            "lang": "es",
            "value": "OpenSSH 7.7 a 7.9 y 8.x anterior de la versi\u00f3n  8.1, cuando se compila con un tipo de clave experimental, tiene un desbordamiento de entero de identificaci\u00f3n  previa si un cliente o servidor est\u00e1 configurado para usar una clave XMSS especialmente dise\u00f1ada. Esto conduce a la corrupci\u00f3n de la memoria y la ejecuci\u00f3n del c\u00f3digo local debido a un error en el algoritmo de an\u00e1lisis de claves XMSS. NOTA: la implementaci\u00f3n de XMSS se considera experimental en todas las versiones de OpenSSH lanzadas, y no hay una forma compatible para habilitarla al crear OpenSSH port\u00e1til."
          }
        ],
        "id": "CVE-2019-16905",
        "lastModified": "2025-04-23T16:15:20.437",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "LOCAL",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 4.4,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 3.4,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2019-10-09T20:15:23.503",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Issue Tracking",
              "Third Party Advisory"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1153537"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Release Notes",
              "Vendor Advisory"
            ],
            "url": "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch"
            ],
            "url": "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c.diff?r1=1.5\u0026r2=1.6\u0026f=h"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.gentoo.org/glsa/201911-01"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20191024-0003/"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://ssd-disclosure.com/archives/4033/ssd-advisory-openssh-pre-auth-xmss-integer-overflow"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Release Notes"
            ],
            "url": "https://www.openssh.com/releasenotes.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2019/10/09/1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Issue Tracking",
              "Third Party Advisory"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1153537"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes",
              "Vendor Advisory"
            ],
            "url": "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c.diff?r1=1.5\u0026r2=1.6\u0026f=h"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.gentoo.org/glsa/201911-01"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20191024-0003/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://ssd-disclosure.com/archives/4033/ssd-advisory-openssh-pre-auth-xmss-integer-overflow"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes"
            ],
            "url": "https://www.openssh.com/releasenotes.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2019/10/09/1"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-190"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2025-11-21T11:54:26+00:00",
      "cve": "CVE-2019-16905",
      "id": "CVE-2019-16905",
      "initial_release_date": "2019-08-28T00:00:00+00:00",
      "product_status:known_not_affected": "27",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "openssh: an integer overflow in the private key parsing code for the XMSS key type",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-16905.json",
      "version": "3"
    }
  }
}

SSA-412672

Vulnerability from csaf_siemens - Published: 2022-12-13 00:00 - Updated: 2022-12-13 00:00

Summary

SSA-412672: Multiple OpenSSL and OpenSSH Vulnerabilities in SCALANCE X-200RNA Switch Devices before V3.2.7

Scope

83 vulnerabilities in this advisory, including CVE-2019-16905.

CVE-2019-16905

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Known affected: 5 products

https://support.industry.siemens.com/cs/ww/en/view/109814809/

Open the full advisory

VAR-201910-0984

Vulnerability from variot - Updated: 2025-04-23 21:55

OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH. OpenSSH Contains an integer overflow vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201911-01

                                       https://security.gentoo.org/

Severity: Normal Title: OpenSSH: Integer overflow Date: November 07, 2019 Bugs: #697046 ID: 201911-01

Synopsis

An integer overflow in OpenSSH might allow an attacker to execute arbitrary code.

Background

OpenSSH is a complete SSH protocol implementation that includes SFTP client and server support.

NOTE: This USE flag is disabled by default!

Impact

A remote attacker could connect to a vulnerable OpenSSH server using a special crafted XMSS key possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

Workaround

Disable XMSS key type.

Resolution

All OpenSSH users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot -v ">=net-misc/openssh/openssh-8.0_p1-r4"

References

[ 1 ] CVE-2019-16905 https://nvd.nist.gov/vuln/detail/CVE-2019-16905

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

https://security.gentoo.org/glsa/201911-01

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

License

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201910-0984",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "openssh",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "openbsd",
        "version": "7.9"
      },
      {
        "model": "openssh",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "openbsd",
        "version": "8.1"
      },
      {
        "model": "scalance x204rna",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.7"
      },
      {
        "model": "openssh",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "openbsd",
        "version": "7.7"
      },
      {
        "model": "openssh",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "openbsd",
        "version": "8.0"
      },
      {
        "model": "steelstore cloud integrated storage",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "scalance x204rna ecc",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.7"
      },
      {
        "model": "cloud backup",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "openbsd",
        "version": "8.1"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "openbsd",
        "version": "7.7 to  7.9"
      },
      {
        "model": "openssh",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "openbsd",
        "version": "8.x"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-010763"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-16905"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:openbsd:openssh",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-010763"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Gentoo",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "155205"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201910-599"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2019-16905",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.4,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 3.4,
            "id": "CVE-2019-16905",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "id": "CVE-2019-16905",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Local",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2019-16905",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2019-16905",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2019-16905",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201910-599",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2019-16905",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-16905"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-010763"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201910-599"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-16905"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH. OpenSSH Contains an integer overflow vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory                           GLSA 201911-01\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n                                           https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n    Title: OpenSSH: Integer overflow\n     Date: November 07, 2019\n     Bugs: #697046\n       ID: 201911-01\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nAn integer overflow in OpenSSH might allow an attacker to execute\narbitrary code. \n\nBackground\n==========\n\nOpenSSH is a complete SSH protocol implementation that includes SFTP\nclient and server support. \n\nNOTE: This USE flag is disabled by default!\n\nImpact\n======\n\nA remote attacker could connect to a vulnerable OpenSSH server using a\nspecial crafted XMSS key possibly resulting in execution of arbitrary\ncode with the privileges of the process or a Denial of Service\ncondition. \n\nWorkaround\n==========\n\nDisable XMSS key type. \n\nResolution\n==========\n\nAll OpenSSH users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot -v \"\u003e=net-misc/openssh/openssh-8.0_p1-r4\"\n\nReferences\n==========\n\n[ 1 ] CVE-2019-16905\n      https://nvd.nist.gov/vuln/detail/CVE-2019-16905\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/201911-01\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2019 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-16905"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-010763"
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-16905"
      },
      {
        "db": "PACKETSTORM",
        "id": "155205"
      }
    ],
    "trust": 1.8
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2019-16905",
        "trust": 2.6
      },
      {
        "db": "SIEMENS",
        "id": "SSA-412672",
        "trust": 1.7
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2019/10/09/1",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-010763",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "155205",
        "trust": 0.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201910-599",
        "trust": 0.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-22-349-21",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-16905",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-16905"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-010763"
      },
      {
        "db": "PACKETSTORM",
        "id": "155205"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201910-599"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-16905"
      }
    ]
  },
  "id": "VAR-201910-0984",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.5566514
  },
  "last_update_date": "2025-04-23T21:55:26.470000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CVS log for src/usr.bin/ssh/sshkey-xmss.c",
        "trust": 0.8,
        "url": "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c"
      },
      {
        "title": "Diff for /src/usr.bin/ssh/sshkey-xmss.c between version 1.5 and 1.6",
        "trust": 0.8,
        "url": "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c.diff?r1=1.5\u0026r2=1.6\u0026f=h"
      },
      {
        "title": "Release Notes",
        "trust": 0.8,
        "url": "https://www.openssh.com/releasenotes.html"
      },
      {
        "title": "OpenSSH Enter the fix for the verification error vulnerability",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=99243"
      },
      {
        "title": "Siemens Security Advisories: Siemens Security Advisory",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=ec6577109e640dac19a6ddb978afe82d"
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/Live-Hack-CVE/CVE-2019-16905 "
      },
      {
        "title": "git-and-crumpets",
        "trust": 0.1,
        "url": "https://github.com/siddicky/git-and-crumpets "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-16905"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-010763"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201910-599"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-190",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-010763"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-16905"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "https://security.gentoo.org/glsa/201911-01"
      },
      {
        "trust": 1.7,
        "url": "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c.diff?r1=1.5\u0026r2=1.6\u0026f=h"
      },
      {
        "trust": 1.7,
        "url": "https://www.openwall.com/lists/oss-security/2019/10/09/1"
      },
      {
        "trust": 1.7,
        "url": "https://www.openssh.com/releasenotes.html"
      },
      {
        "trust": 1.7,
        "url": "https://bugzilla.suse.com/show_bug.cgi?id=1153537"
      },
      {
        "trust": 1.7,
        "url": "https://ssd-disclosure.com/archives/4033/ssd-advisory-openssh-pre-auth-xmss-integer-overflow"
      },
      {
        "trust": 1.7,
        "url": "https://security.netapp.com/advisory/ntap-20191024-0003/"
      },
      {
        "trust": 1.7,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
      },
      {
        "trust": 1.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-16905"
      },
      {
        "trust": 1.1,
        "url": "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-16905"
      },
      {
        "trust": 0.7,
        "url": "https://0day.life/exploits/0day-1009.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/support/pages/node/1143460"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/155205/gentoo-linux-security-advisory-201911-01.html"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/190.html"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/live-hack-cve/cve-2019-16905"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://www.symantec.com/content/symantec/english/en/security-center/vulnerabilities/writeup.html/110605"
      },
      {
        "trust": 0.1,
        "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-21"
      },
      {
        "trust": 0.1,
        "url": "https://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.1,
        "url": "https://security.gentoo.org/"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.gentoo.org."
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-16905"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-010763"
      },
      {
        "db": "PACKETSTORM",
        "id": "155205"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201910-599"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-16905"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2019-16905"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-010763"
      },
      {
        "db": "PACKETSTORM",
        "id": "155205"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201910-599"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-16905"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-10-09T00:00:00",
        "db": "VULMON",
        "id": "CVE-2019-16905"
      },
      {
        "date": "2019-10-23T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-010763"
      },
      {
        "date": "2019-11-08T15:36:32",
        "db": "PACKETSTORM",
        "id": "155205"
      },
      {
        "date": "2019-10-09T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201910-599"
      },
      {
        "date": "2019-10-09T20:15:23.503000",
        "db": "NVD",
        "id": "CVE-2019-16905"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-03-01T00:00:00",
        "db": "VULMON",
        "id": "CVE-2019-16905"
      },
      {
        "date": "2019-10-23T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-010763"
      },
      {
        "date": "2022-12-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201910-599"
      },
      {
        "date": "2025-04-23T16:15:20.437000",
        "db": "NVD",
        "id": "CVE-2019-16905"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201910-599"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "OpenSSH Integer overflow vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-010763"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "input validation error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201910-599"
      }
    ],
    "trust": 0.6
  }
}

WID-SEC-W-2023-0998

Vulnerability from csaf_certbund - Published: 2019-10-09 22:00 - Updated: 2024-04-16 22:00

Summary

OpenSSH: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten

Severity

Hoch

Scope

1 vulnerability in this advisory, including CVE-2019-16905.

CVE-2019-16905

Es besteht eine Schwachstelle in OpenSSH, wenn es mit der XMSS-Implementierung kompiliert wurde (die als EXPERIMENTELL gilt). Ein anonymer Angreifer kann mit einem speziell entwickelten XMSS-Schlüssel eine Speicherbeschädigung auslösen, um beliebigen Code als "root"-Benutzer auszuführen.

Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2019-16905 (GCVE-0-2019-16905)

SSA-412672

VAR-201910-0984

Synopsis

Background

Impact

Workaround

Resolution

References

Availability

Concerns?

License

WID-SEC-W-2023-0998

Tags

Sightings

Nomenclature

Related by attack behaviour