Timing Attacks on Password Entry in OpenSSH

CVE-2024-39894

What is CVE-2024-39894?

OpenSSH versions from 9.5 to 9.7 exhibit a vulnerability that may allow timing attacks against echo-off password entries, particularly affecting commands such as 'su' and 'Sudo'. The issue arises due to a logic error in ObscureKeystrokeTiming, which could enable attackers to infer password characters over time. To ensure the security of your systems, it's crucial to update to OpenSSH version 9.8 or later, which addresses this vulnerability.

References