CVE-2015-5600

It was discovered that the OpenSSH sshd daemon did not check the list of keyboard-interactive authentication methods for duplicates. A remote attacker could use this flaw to bypass the MaxAuthTries limit, making it easier to perform password guessing attacks.

This issue does not affect the default OpenSSH sshd configuration in Red Hat Enterprise Linux 4, 5, 6 and 7.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This issue can be mitigated by disabling keyboard-interactive authentication method. That can be achieved by setting "ChallengeResponseAuthentication no" in the /etc/ssh/sshd_config configuration file and restarting the sshd service.