CVE-2001-0361: OpenBSD OpenSSH

Medium severity, CVSS 4.0. EPSS: 2.5% chance of exploitation in the next 30 days.

Implementations of SSH version 1.5, including (1) OpenSSH up to version 2.3.0, (2) AppGate, and (3) ssh-1 up to version 1.2.31, in certain configurations, allow a remote attacker to decrypt and/or alter traffic via a "Bleichenbacher attack" on PKCS#1 version 1.5.

Affected products

• OpenBSD OpenSSH: version 1.2.3 only; version 2.1 only; version 2.1.1 only
• SSH SSH: up to and including 1.2.31

Published 2001-06-27. Last modified 2026-06-16.