Severity : |
Medium
|
Published : |
2011-02-10
|
Modified : |
2014-08-08
|
Base Score : |
5.0
|
Details : |
The key_certify function in usr.bin/ssh/key.c in OpenSSH 5.6 and 5.7, when generating legacy certificates using the -t command-line option in ssh-keygen, does not initialize the nonce field, which might allow remote attackers to obtain sensitive stack memory contents or make it easier to conduct hash collision attacks.
|
Product/Version : |
Carrier Grade CGE 6.0
|
|