CVE-2024-39894 affects OpenSSH versions 9.5 through 9.7 before 9.8, where a logic error in the ObscureKeystrokeTiming implementation can enable timing attacks against echo-off password entry mechanisms, such as those used by su and sudo. This vulnerability may also allow similar timing attacks against other keystroke entry processes. The CVSS 3.1 vector indicates network attack complexity is high, user interaction is required, and the impact on confidentiality, integrity, and availability is high. No patch or vendor advisory is currently referenced, and no exploits are known in the wild.

Successful exploitation could lead to disclosure of sensitive password input through timing analysis, potentially compromising user credentials during privileged operations like su and sudo. The vulnerability impacts confidentiality, integrity, and availability with high severity as per the CVSS score. However, no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider minimizing exposure of affected OpenSSH versions and monitor for vendor updates. Avoid relying solely on echo-off password entry mechanisms in affected versions for sensitive authentication.