Configuration Affecting openssh package, versions <1:3.6p1-1
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN11-OPENSSH-515708
- published 31 Dec 2004
- disclosed 31 Dec 2004
Introduced: 31 Dec 2004
CVE-2004-2760 Open this link in a new tabHow to fix?
Upgrade Debian:11 openssh to version 1:3.6p1-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream openssh package and not the openssh package as distributed by Debian.
See How to fix? for Debian:11 relevant fixed versions and status.
sshd in OpenSSH 3.5p1, when PermitRootLogin is disabled, immediately closes the TCP connection after a root login attempt with the correct password, but leaves the connection open after an attempt with an incorrect password, which makes it easier for remote attackers to guess the password by observing the connection state, a different vulnerability than CVE-2003-0190. NOTE: it could be argued that in most environments, this does not cross privilege boundaries without requiring leverage of a separate vulnerability.