Candidate: CVE-2016-8858
PublicDate: 2016-12-09 11:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8858
 http://seclists.org/oss-sec/2016/q4/185
Description:
 ** DISPUTED ** The kex_input_kexinit function in kex.c in OpenSSH 6.x and
 7.x through 7.3 allows remote attackers to cause a denial of service
 (memory consumption) by sending many duplicate KEXINIT requests.  NOTE: a
 third party reports that "OpenSSH upstream does not consider this as a
 security issue."
Ubuntu-Description:
Notes:
 mdeslaur> DoS is limited to attacker's connection only, and openssh
 mdeslaur> upstream does not consider this to be a security issue
 mdeslaur> We do not consider this to be a security issue either, marking
 mdeslaur> as ignored
Bugs:
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=848717
Priority: negligible
Discovered-by:
Assigned-to: sbeattie
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]

Patches_openssh:
 upstream: https://github.com/openssh/openssh-portable/commit/ec165c392ca54317dbe3064a8c200de6531e89ad
upstream_openssh: needs-triage
precise_openssh: ignored (reached end-of-life)
precise/esm_openssh: ignored
trusty_openssh: ignored
trusty/esm_openssh: ignored
vivid/stable-phone-overlay_openssh: ignored (reached end-of-life)
vivid/ubuntu-core_openssh: ignored (reached end-of-life)
xenial_openssh: ignored
esm-infra/xenial_openssh: ignored
yakkety_openssh: ignored (reached end-of-life)
zesty_openssh: not-affected (1:7.3p1-2)
artful_openssh: not-affected (1:7.3p1-2)
devel_openssh: not-affected (1:7.3p1-2)