Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Echo OpenSSH lacks S/KEY/OPIE support, no exposure
published 9 months ago
Summary
The OpenSSH version used in Echo does not contain the optional S/KEY or OPIE authentication libraries. Because those authentication methods are absent, the known weakness cannot be triggered on Echo systems. No action is required for Echo deployments, but other OpenSSH installations that do include these libraries should review their configuration.
What to do
- Update echo openssh to version 1:9.2p1-2+deb12u6.
- Update openssh to version 1:9.2p1-2+deb12u6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Echo | echo | openssh |
< 1:9.2p1-2+deb12u6 Fix: upgrade to 1:9.2p1-2+deb12u6
|
| Echo | – | openssh |
< 1:9.2p1-2+deb12u6 Fix: upgrade to 1:9.2p1-2+deb12u6
|
Original advisory text
This vulnerability is not applicable as Echo images do not ship with libraries
enabling S/KEY or OPIE authentication.
https://security-tracker.debian.org/tracker/CVE-2007-2768
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=112279
References
Timeline
Published29 Jan 2026
Updated15 Sep 2026
First seen10 Apr 2026
Sources
ECHO-df10-54df-ba97 · OSV
Track software like this
Free during beta