critical 9.8

CVE-2016-1908 in the critical feed json

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for ac…

published 2017-04-11 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-2999

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 13.7%; EPSS 13.7% chance of exploitation in 30 days, percentile 96%
public exploits: 0; none known

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.

Patch / fix

fixed in 1 distros 4 links 2

openbsd openssh 7.2

debian ubuntu red hat suse

openssh Debian 14, Debian 13, Debian 12 1:7.2p1-1

debian advisories DEBIAN-CVE-2016-1908

openssh Ubuntu 14.04 LTS 1:6.6p1-2ubuntu2.7

ubuntu advisories UBUNTU-CVE-2016-1908

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

openssh RHEL 7 6.6.1p1-25.el7_2
openssh-ldap RHEL 7 6.6.1p1-25.el7_2
openssh-keycat RHEL 7 6.6.1p1-25.el7_2
openssh-server RHEL 7 6.6.1p1-25.el7_2
openssh-askpass RHEL 7 6.6.1p1-25.el7_2
openssh-clients RHEL 7 6.6.1p1-25.el7_2
pam_ssh_agent_auth RHEL 7 0.9.3-9.25.el7_2
openssh-server-sysvinit RHEL 7 6.6.1p1-25.el7_2

red hat advisories RHSA-2016:0465 RHSA-2016:0741

openssh-openssl1 SLES 11-SECURITY 6.6p1-15.1
openssh SLES 11 SP3-TERADATA, SLES 11 SP3-LTSS, SLE Point of Sale 11 SP3 +3 more 6.2p2-0.33.2
openssh-askpass-gnome SLES 11 SP3-TERADATA, SLES 11 SP3-LTSS, SLE Point of Sale 11 SP3 +3 more 6.2p2-0.33.5
openssh SLES for SAP 11 SP4, SLES 11 SP4 6.6p1-21.1
openssh-askpass-gnome SLES for SAP 11 SP4, SLES 11 SP4 6.6p1-21.3
openssh SLES for SAP 12 SP1, SLES for SAP 12, SLES 12 SP1 +3 more 6.6p1-42.1
openssh-askpass-gnome SLES for SAP 12 SP1, SLES for SAP 12, SLES 12 SP1 +3 more 6.6p1-42.1

suse advisories SUSE-SU-2016:2555-1 SUSE-SU-2016:2388-1 SUSE-SU-2016:1528-1 SUSE-SU-2016:1386-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-1908 updated 2026-11-05 cvss 4.9

openssh: possible fallback from untrusted to trusted X11 forwarding

Red Hat Enterprise Linux 5 openssh
affected: no fix planned “Will not fix”
Red Hat Enterprise Linux Client (v. 7) openssh 6.6.1p1-25.el7_2, openssh-keycat 6.6.1p1-25.el7_2, openssh-server 6.6.1p1-25.el7_2, openssh-askpass 6.6.1p1-25.el7_2, openssh-clients 6.6.1p1-25.el7_2 Red Hat Enterprise Linux Client Optional (v. 7) openssh-ldap 6.6.1p1-25.el7_2, pam_ssh_agent_auth 0.9.3-9.25.el7_2, openssh-server-sysvinit 6.6.1p1-25.el7_2 Red Hat Enterprise Linux ComputeNode (v. 7) openssh 6.6.1p1-25.el7_2, openssh-keycat 6.6.1p1-25.el7_2, openssh-server 6.6.1p1-25.el7_2, openssh-clients 6.6.1p1-25.el7_2 Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssh-ldap 6.6.1p1-25.el7_2, openssh-askpass 6.6.1p1-25.el7_2, pam_ssh_agent_auth 0.9.3-9.25.el7_2, openssh-server-sysvinit 6.6.1p1-25.el7_2
fixed: vendor fix RHSA-2016:0465
Red Hat Enterprise Linux Desktop (v. 6) openssh 5.3p1-117.el6, openssh-server 5.3p1-117.el6, openssh-askpass 5.3p1-117.el6, openssh-clients 5.3p1-117.el6 Red Hat Enterprise Linux Desktop Optional (v. 6) openssh-ldap 5.3p1-117.el6, pam_ssh_agent_auth 0.9.3-117.el6 Red Hat Enterprise Linux HPC Node (v. 6) openssh 5.3p1-117.el6, openssh-server 5.3p1-117.el6, openssh-clients 5.3p1-117.el6 Red Hat Enterprise Linux HPC Node Optional (v. 6) openssh-ldap 5.3p1-117.el6, openssh-askpass 5.3p1-117.el6, pam_ssh_agent_auth 0.9.3-117.el6 Red Hat Enterprise Linux Server (v. 6) openssh 5.3p1-117.el6, openssh-server 5.3p1-117.el6, openssh-askpass 5.3p1-117.el6, openssh-clients 5.3p1-117.el6
fixed: vendor fix RHSA-2016:0741
Red Hat Enterprise Linux Server (v. 7) openssh 6.6.1p1-25.el7_2, openssh-keycat 6.6.1p1-25.el7_2, openssh-server 6.6.1p1-25.el7_2, openssh-askpass 6.6.1p1-25.el7_2, openssh-clients 6.6.1p1-25.el7_2
fixed: vendor fix RHSA-2016:0465
Red Hat Enterprise Linux Server Optional (v. 6) openssh-ldap 5.3p1-117.el6, pam_ssh_agent_auth 0.9.3-117.el6
fixed: vendor fix RHSA-2016:0741
Red Hat Enterprise Linux Server Optional (v. 7) openssh-ldap 6.6.1p1-25.el7_2, pam_ssh_agent_auth 0.9.3-9.25.el7_2, openssh-server-sysvinit 6.6.1p1-25.el7_2
fixed: vendor fix RHSA-2016:0465
Red Hat Enterprise Linux Workstation (v. 6) openssh 5.3p1-117.el6, openssh-server 5.3p1-117.el6, openssh-askpass 5.3p1-117.el6, openssh-clients 5.3p1-117.el6
fixed: vendor fix RHSA-2016:0741
Red Hat Enterprise Linux Workstation (v. 7) openssh 6.6.1p1-25.el7_2, openssh-keycat 6.6.1p1-25.el7_2, openssh-server 6.6.1p1-25.el7_2, openssh-askpass 6.6.1p1-25.el7_2, openssh-clients 6.6.1p1-25.el7_2
fixed: vendor fix RHSA-2016:0465

show 2 more

Red Hat Enterprise Linux Workstation Optional (v. 6) openssh-ldap 5.3p1-117.el6, pam_ssh_agent_auth 0.9.3-117.el6
fixed: vendor fix RHSA-2016:0741
Red Hat Enterprise Linux Workstation Optional (v. 7) openssh-ldap 6.6.1p1-25.el7_2, pam_ssh_agent_auth 0.9.3-9.25.el7_2, openssh-server-sysvinit 6.6.1p1-25.el7_2
fixed: vendor fix RHSA-2016:0465

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-349-21 updated 2022-12-13 cvss 9.8

Siemens SCALANCE X-200RNA Switch Devices

Siemens SCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2) <V3.2.7 Siemens SCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2) <V3.2.7 Siemens SCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3) <V3.2.7 Siemens SCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3) <V3.2.7 Siemens SCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3) <V3.2.7
affected: fixed in V3.2.7, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 5 mo ago (2026-05-29)

Exploit prediction

13.74% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-287 Improper Authentication

References

anongit.mindrot.org /openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c
patch, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=1298741
issue-tracking, patch, third-party-advisory
rhn.redhat.com /errata/RHSA-2016-0741.html
vendor-advisory, third-party-advisory
security.gentoo.org /glsa/201612-18
vendor-advisory, third-party-advisory
rhn.redhat.com /errata/RHSA-2016-0465.html
vendor-advisory, third-party-advisory
openssh.com /txt/release-7.2
release-notes, vendor-advisory
oracle.com /technetwork/topics/security/linuxbulletinapr2016-2952096.html
third-party-advisory
openwall.com /lists/oss-security/2016/01/15/13
mailing-list, third-party-advisory
securitytracker.com /id/1034705
vdb-entry, broken-link, third-party-advisory
lists.debian.org /debian-lts-announce/2018/09/msg00010.html
mailing-list, third-party-advisory
securityfocus.com /bid/84427
vdb-entry, third-party-advisory
cert-portal.siemens.com /productcert/pdf/ssa-412672.pdf

Sources

CVE List CVE-2016-1908
NVD CVE-2016-1908

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary