A vulnerability in DenyHosts could allow a remote attacker to create a Denial of Service condition.
|Package||app-admin/denyhosts on all architectures|
|Affected versions||< 2.6-r9|
|Unaffected versions||>= 2.6-r9|
DenyHosts is a script intended to be run by Linux system administrators to help thwart SSH server attacks.
DenyHosts does not properly define the regular expressions used when parsing SSH authentication logs.
A remote attacker could possibly cause a Denial of Service condition via a crafted login name.
There is no known workaround at this time.
All DenyHost users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/denyhosts-2.6-r9"
June 25, 2014
June 25, 2014: 1