MEDIUM
security flaw
Published Sep 6, 2005
5.0
MEDIUMCVSS 2.0
EPSS 2.30%
Description
sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is enabled, allows GSSAPI credentials to be delegated to clients who log in using non-GSSAPI methods, which could cause those credentials to be exposed to untrusted users or hosts.
Affected products
No data.
OR
- 3.0
- 3.0.1
- 3.0.1p1
- 3.0.2
- 3.0.2p1
- 3.0p1
- 3.1
- 3.1p1
- 3.2
- 3.2.2p1
- 3.2.3p1
- 3.3
- 3.3p1
- 3.4
- 3.4p1
- 3.5
- 3.5p1
- 3.6
- 3.6.1
- 3.6.1p1
- 3.6.1p2
- 3.7
- 3.7.1
- 3.7.1p2
- 3.8
- 3.8.1
- 3.8.1p1
- 3.9
- 3.9.1
- 3.9.1p1
- 4.0p1
- 4.1p1
No data.
Red Hat Enterprise Linux 4
openssh-0:3.9p1-8.RHEL4.9
Fixed · RHSA-2005:527
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 4 | openssh-0:3.9p1-8.RHEL4.9 | Fixed | RHSA-2005:527 |
No package ranges for this CVE.
Remediation
Red Hat statement
This issue does not affect Red Hat Enterprise Linux 2.1 and 3. This flaw was fixed in Red Hat Enterprise Linux 4 via errata RHSA-2005:527: http://rhn.redhat.com/errata/RHSA-2005-527.html
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
5.0 MEDIUM NVD
AV:N/AC:L/Au:N/C:P/I:N/A:N
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact None
Availability Impact None
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
2.30% 0.02299
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.02299
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (18 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 2.30% (0.02299) | 82.67th | v5 (v2026.06.15) |
| Jun 15, 2026 | 2.30% (0.02299) | 80.97th | v5 (v2026.06.15) |
| Dec 28, 2025 | 2.70% (0.02700) | 85.43th | v4 (v2025.03.14) |
| Dec 27, 2025 | 3.98% (0.03977) | 88.09th | v4 (v2025.03.14) |
| Oct 28, 2025 | 2.70% (0.02700) | 85.33th | v4 (v2025.03.14) |
| Oct 27, 2025 | 3.98% (0.03977) | 87.92th | v4 (v2025.03.14) |
| Oct 1, 2025 | 2.70% (0.02700) | 85.39th | v4 (v2025.03.14) |
| Jul 30, 2025 | 3.98% (0.03977) | 87.95th | v4 (v2025.03.14) |
| Mar 30, 2025 | 2.74% (0.02736) | 84.68th | v4 (v2025.03.14) |
| Mar 29, 2025 | 7.13% (0.07128) | 85.58th | v4 (v2025.03.14) |
| Mar 19, 2025 | 2.74% (0.02736) | 84.37th | v4 (v2025.03.14) |
| Mar 17, 2025 | 1.64% (0.01637) | 80.64th | v4 (v2025.03.14) |
| Dec 12, 2024 | 1.02% (0.01017) | 84.44th | v3 (v2023.03.01) |
| May 3, 2024 | 1.36% (0.01362) | 86.12th | v3 (v2023.03.01) |
| Mar 7, 2023 | 1.36% (0.01362) | 84.12th | v3 (v2023.03.01) |
| Mar 6, 2023 | 2.69% (0.02686) | 82.85th | v2 (v2022.01.01) |
| Apr 1, 2022 | 2.69% (0.02686) | 81.17th | v2 (v2022.01.01) |
| Feb 4, 2022 | 2.69% (0.02686) | 62.66th | v2 (v2022.01.01) |
Weaknesses (0)
No CWE recorded.
References (29)
- ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.53/SCOSA-2005.53.txt vendor-advisoryx_refsource_SCO
- http://lists.suse.com/archive/suse-security-announce/2006-Feb/0001.html vendor-advisoryx_refsource_SUSE
- http://secunia.com/advisories/16686 third-party-advisoryx_refsource_SECUNIAPatchVendor Advisory
- http://secunia.com/advisories/17077 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/17245 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18010 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18406 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18507 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18661 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18717 third-party-advisoryx_refsource_SECUNIA
- http://securitytracker.com/id?1014845 vdb-entryx_refsource_SECTRACK
- http://support.avaya.com/elmodocs2/security/ASA-2006-016.htm x_refsource_CONFIRM
- http://support.avaya.com/elmodocs2/security/ASA-2006-033.htm x_refsource_CONFIRM
- http://www.mandriva.com/security/advisories?name=MDKSA-2005:172 vendor-advisoryx_refsource_MANDRIVA
- http://www.mindrot.org/pipermail/openssh-unix-announce/2005-September/000083.html mailing-listx_refsource_MLIST
- http://www.osvdb.org/19141 vdb-entryx_refsource_OSVDB
- http://www.redhat.com/support/errata/RHSA-2005-527.html vendor-advisoryx_refsource_REDHAT
- http://www.securityfocus.com/archive/1/421411/100/0/threaded vendor-advisoryx_refsource_HP
- http://www.securityfocus.com/bid/14729 vdb-entryx_refsource_BID
- http://www.vupen.com/english/advisories/2006/0144 vdb-entryx_refsource_VUPEN
- https://access.redhat.com/security/cve/CVE-2005-2798 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1617757 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24064 vdb-entryx_refsource_XF
- https://nvd.nist.gov/vuln/detail/CVE-2005-2798
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1345 vdb-entrysignaturex_refsource_OVAL
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1566 vdb-entrysignaturex_refsource_OVAL
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9717 vdb-entrysignaturex_refsource_OVAL
- https://usn.ubuntu.com/209-1/ vendor-advisoryx_refsource_UBUNTU
- https://www.cve.org/CVERecord?id=CVE-2005-2798
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Sep 6, 2005
Updated Aug 7, 2024
Reserved Sep 6, 2005
Link CVE-2005-2798
CISA Vulnrichment
Updated n/a