p PatchFirst

CVE-2005-2666

CVE-2005-2666

This page contains facts from public vulnerability sources. Check the original advisory before updating.

SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.

EPSS 1.2% · Fix available

Published
Updated

Stack: system · network

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • openssh Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:4.0p1-1

    Update to 1:4.0p1-1

  • openssh Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:4.0p1-1

    Update to 1:4.0p1-1

  • openssh Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:4.0p1-1

    Update to 1:4.0p1-1

Original sources

Check your server →