Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

OpenSSH may reveal password length and key details

CVE-2001-0572 · published 25 years ago
Summary

The SSH services provided by OpenSSH can leak information such as password length, the type of key used, and command size to an eavesdropper on the network. This makes it easier for attackers to guess passwords or target specific authentication methods. Apply the latest security patches and consider using encrypted tunnels or VPNs to protect traffic.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
openbsd openssh 4.5
cpe:2.3:a:openbsd:openssh:4.5:*:*:*:*:*:*:*
ssh ssh 1.2.24
1.2.25
1.2.26
1.2.27
1.2.28
1.2.29
1.2.30
1.2.31
cpe:2.3:a:ssh:ssh:1.2.24:*:*:*:*:*:*:*
Original advisory text
The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have various weaknesses which can allow a remote attacker to obtain the following information via sniffing: (1) pa...
The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have various weaknesses which can allow a remote attacker to obtain the following information via sniffing: (1) password lengths or ranges of lengths, which simplifies brute force password guessing, (2) whether RSA or DSA authentication is being used, (3) the number of authorized_keys in RSA authentication, or (4) the lengths of shell commands.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
7% chance of attack within 30 days
Timeline
Published22 Aug 2001
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2001-0572 · NVD
Track software like this
Free during beta