NetSight
IP …
medium5.3Public exploit code

CVE-2018-15473

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containi…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

Affected products

VendorProductAffected versions
OpenbsdOpenssh
through 7.7
DebianDebian Linux
Versions 8.0, 9.0
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 18.04
NetappCn1610 Firmware
All versions
NetappAff Baseboard Management Controller
All versions
NetappCloud Backup
All versions
NetappData Ontap Edge
All versions
NetappFas Baseboard Management Controller
All versions
NetappOncommand Unified Manager
from 9.4

Weakness classification

CWE-362

References