CVE-2008-5161

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

• ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
• AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
• Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

18.55% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 97.0% of scored records. A rank, not a probability.

NVD base score

3.7 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD analysis status

Modified. NVD last modified this record on 2026-06-16.

Red Hat severity

Low. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2008-11-19 17:00Z17 YR AGO

Last updated

2026-05-28 18:11Z3 MO AGO

Reserved

2008-11-19

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Low (CVSS 3.7)

CNA CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses

• CWE-329Generation of Predictable IV with CBC ModeVariant
• CWE-200Exposure of Sensitive Information to an Unauthorized ActorClass

Data version

5.2

Document digest

7a7c6ac377e2e9065a21148d38a79fa1477b1408f1731dd04d96317607e6f256

• openssh.orghttp://openssh.org/txt/cbc.advx_refsource_CONFIRM
• sunsolve.sun.com247186http://sunsolve.sun.com/search/document.do?assetkey=1-66-247186-1vendor-advisoryx_refsource_SUNALERT
• www.securityfocus.com32319http://www.securityfocus.com/bid/32319vdb-entryx_refsource_BID
• secunia.com33121http://secunia.com/advisories/33121third-party-advisoryx_refsource_SECUNIA
• h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667x_refsource_CONFIRM
• osvdb.org49872http://osvdb.org/49872vdb-entryx_refsource_OSVDB
• secunia.com33308http://secunia.com/advisories/33308third-party-advisoryx_refsource_SECUNIA
• rhn.redhat.comRHSA-2009:1287http://rhn.redhat.com/errata/RHSA-2009-1287.htmlvendor-advisoryx_refsource_REDHAT
• www.cpni.gov.ukhttp://www.cpni.gov.uk/Docs/Vulnerability_Advisory_SSH.txtx_refsource_MISC
• www.securitytracker.com1021382http://www.securitytracker.com/id?1021382vdb-entryx_refsource_SECTRACK
• kc.mcafee.comhttps://kc.mcafee.com/corporate/index?page=content&id=SB10163x_refsource_CONFIRM
• osvdb.org50036http://osvdb.org/50036vdb-entryx_refsource_OSVDB
• secunia.com32833http://secunia.com/advisories/32833third-party-advisoryx_refsource_SECUNIA
• secunia.com36558http://secunia.com/advisories/36558third-party-advisoryx_refsource_SECUNIA
• osvdb.org50035http://osvdb.org/50035vdb-entryx_refsource_OSVDB
• www.ssh.comhttp://www.ssh.com/company/news/article/953/x_refsource_CONFIRM
• www.securitytracker.com1021235http://www.securitytracker.com/id?1021235vdb-entryx_refsource_SECTRACK
• secunia.com34857http://secunia.com/advisories/34857third-party-advisoryx_refsource_SECUNIA
• support.avaya.comhttp://support.avaya.com/elmodocs2/security/ASA-2008-503.htmx_refsource_MISC
• support.attachmate.comhttp://support.attachmate.com/techdocs/2398.htmlx_refsource_CONFIRM
• www.rtpro.yamaha.co.jphttp://www.rtpro.yamaha.co.jp/RT/FAQ/Security/CPNI957037.htmlx_refsource_CONFIRM
• www.vupen.comADV-2008-3173http://www.vupen.com/english/advisories/2008/3173vdb-entryx_refsource_VUPEN
• www.securityfocus.com20081123 Revised: OpenSSH security advisory: cbc.advhttp://www.securityfocus.com/archive/1/498579/100/0/threadedmailing-listx_refsource_BUGTRAQ
• exchange.xforce.ibmcloud.comopenssh-sshtectia-cbc-info-disclosure(46620)https://exchange.xforce.ibmcloud.com/vulnerabilities/46620vdb-entryx_refsource_XF
• secunia.com32740http://secunia.com/advisories/32740third-party-advisoryx_refsource_SECUNIA
• www.vupen.comADV-2009-1135http://www.vupen.com/english/advisories/2009/1135vdb-entryx_refsource_VUPEN
• secunia.com32760http://secunia.com/advisories/32760third-party-advisoryx_refsource_SECUNIA
• www.vupen.comADV-2009-3184http://www.vupen.com/english/advisories/2009/3184vdb-entryx_refsource_VUPEN
• kb.juniper.nethttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705x_refsource_CONFIRM
• www.securitytracker.com1021236http://www.securitytracker.com/id?1021236vdb-entryx_refsource_SECTRACK
• kc.mcafee.comhttps://kc.mcafee.com/corporate/index?page=content&id=SB10106x_refsource_CONFIRM
• marc.infoHPSBMA02447http://marc.info/?l=bugtraq&m=125017764422557&w=2vendor-advisoryx_refsource_HP
• isc.sans.orghttp://isc.sans.org/diary.html?storyid=5366x_refsource_MISC
• lists.apple.comAPPLE-SA-2009-11-09-1http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.htmlvendor-advisoryx_refsource_APPLE
• www.vupen.comADV-2008-3409http://www.vupen.com/english/advisories/2008/3409vdb-entryx_refsource_VUPEN
• www.vupen.comADV-2008-3172http://www.vupen.com/english/advisories/2008/3172vdb-entryx_refsource_VUPEN
• oval.cisecurity.orgoval:org.mitre.oval:def:11279https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11279vdb-entrysignaturex_refsource_OVAL
• www.securityfocus.com20081121 OpenSSH security advisory: cbc.advhttp://www.securityfocus.com/archive/1/498558/100/0/threadedmailing-listx_refsource_BUGTRAQ
• support.apple.comhttp://support.apple.com/kb/HT3937x_refsource_CONFIRM
• www.kb.cert.orgVU#958563http://www.kb.cert.org/vuls/id/958563third-party-advisoryx_refsource_CERT-VN