CVE-2007-0844: Pam SSH

Medium severity, CVSS 6.4. EPSS: 0.9% chance of exploitation in the next 30 days.

The auth_via_key function in pam_ssh.c in pam_ssh before 1.92, when the allow_blank_passphrase option is disabled, allows remote attackers to bypass authentication restrictions and use private encryption keys requiring a blank passphrase by entering a non-blank passphrase.

Affected products

• Pam SSH Pam SSH: version 1.91 only

Published 2007-02-08. Last modified 2026-06-16.