critical
CVE-2016-1908
openssh: possible fallback from untrusted to trusted X11 forwarding
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.9AV:N/AC:M/Au:S/C:P/I:P/A:N
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (medium), Amazon (medium), Oracle (medium), Ubuntu (low).
Description
The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 1 | openssh, openssh-clients, openssh-debuginfo and 4 more | 6.6.1p1-25.61.amzn1 and 1 more |
| debian 11 | openssh | 1:7.2p1-1 |
| debian 12 | openssh | 1:7.2p1-1 |
| debian 13 | openssh | 1:7.2p1-1 |
| debian 14 | openssh | 1:7.2p1-1 |
| debian 7 | openssh | no fix listed |
| debian 8 | openssh | 1:6.7p1-5+deb8u6 |
| echo | openssh | 1:7.2p1-1 |
| Oracle Linux 6 | openssh, openssh-askpass, openssh-clients and 3 more | 5.3p1-117.el6 and 1 more |
| Oracle Linux 7 | openssh, openssh-askpass, openssh-clients and 5 more | 6.6.1p1-25.el7_2 and 1 more |
| root.io debian 11 | rootio-openssh | 1:7.2p1-1 |
| root.io debian 12 | rootio-openssh | 1:7.2p1-1 |
Show all 37 entries from 18 sources
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 1 | openssh | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-clients | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-debuginfo | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-keycat | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-ldap | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-server | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | pam_ssh_agent_auth | 0.9.3-9.25.61.amzn1 |
| debian 11 | openssh | 1:7.2p1-1 |
| debian 12 | openssh | 1:7.2p1-1 |
| debian 13 | openssh | 1:7.2p1-1 |
| debian 14 | openssh | 1:7.2p1-1 |
| debian 7 | openssh | no fix listed |
| debian 8 | openssh | 1:6.7p1-5+deb8u6 |
| echo | openssh | 1:7.2p1-1 |
| Oracle Linux 6 | openssh | 5.3p1-117.el6 |
| Oracle Linux 6 | openssh-askpass | 5.3p1-117.el6 |
| Oracle Linux 6 | openssh-clients | 5.3p1-117.el6 |
| Oracle Linux 6 | openssh-ldap | 5.3p1-117.el6 |
| Oracle Linux 6 | openssh-server | 5.3p1-117.el6 |
| Oracle Linux 6 | pam_ssh_agent_auth | 0.9.3-117.el6 |
| Oracle Linux 7 | openssh | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-askpass | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-clients | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-keycat | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-ldap | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-server | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-server-sysvinit | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | pam_ssh_agent_auth | 0.9.3-9.25.el7_2 |
| root.io debian 11 | rootio-openssh | 1:7.2p1-1 |
| root.io debian 12 | rootio-openssh | 1:7.2p1-1 |
| root.io debian 13 | rootio-openssh | 1:7.2p1-1 |
| seal Red Hat 6 | openssh | 5.3p1-124.el6_10+sp999 |
| seal Red Hat 6 | seal-openssh | 5.3p1-124.el6_10+sp999 |
| ubuntu 12.04 | openssh | 1:5.9p1-5ubuntu1.9 |
| ubuntu 14.04 | openssh | 1:6.6p1-2ubuntu2.7 |
| ubuntu 14.04-ESM | openssh | 1:6.6p1-2ubuntu2.7 |
| ubuntu 15.10 | openssh | 1:6.9p1-2ubuntu0.2 |
References
- http://openwall.com/lists/oss-security/2016/01/15/13
- http://rhn.redhat.com/errata/RHSA-2016-0465.html
- http://rhn.redhat.com/errata/RHSA-2016-0741.html
- http://seclists.org/oss-sec/2016/q1/115
- http://www.openssh.com/txt/release-7.2
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.securityfocus.com/bid/84427
- http://www.securitytracker.com/id/1034705
All 21 references
- https://access.redhat.com/security/cve/CVE-2016-1908
- https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c
- https://bugzilla.redhat.com/show_bug.cgi?id=1298741
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://linux.oracle.com/cve/CVE-2016-1908.html
- https://linux.oracle.com/errata/ELSA-2016-0741.html
- https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html
- https://lists.mindrot.org/pipermail/openssh-unix-dev/2016-January/034684.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-1908
- https://security.gentoo.org/glsa/201612-18
- https://thejh.net/written-stuff/openssh-6.8-xsecurity
- https://ubuntu.com/security/notices/USN-2966-1
- https://www.cve.org/CVERecord?id=CVE-2016-1908