openssh: weakness of agent locking (ssh-add -x) to password guessing

Description

It was found that the OpenSSH ssh-agent, a program to hold private keys used for public key authentication, was vulnerable to password guessing attacks. An attacker able to connect to the agent could use this flaw to conduct a brute-force attack to unlock keys in the ssh-agent.

Affected Applications

openssh

References