CVE-2024-39894

Summary

CVE-2024-39894 is a vulnerability affecting OpenSSH versions 9.5 through 9.7. This issue involves a logic error in the ObscureKeystrokeTiming feature, which could allow timing attacks against echo-off password entry during su and Sudo operations. The vulnerability exposes the system to potential unauthorized access through keystroke input manipulation. Other similar timing attacks against keystroke entry may also pose a threat. Users are advised to upgrade to OpenSSH version 9.8 to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.