CVE-2018-15473
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 98.7%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 98.67% probability · 100th percentile
- Public exploits
- 3 in Exploit-DB · verified · first 16 August 2018
- CISA KEV
- Not listed
- Weakness
- CWE-362
- Affected
- openbsd/openssh · debian/debian linux · redhat/enterprise linux desktop · redhat/enterprise linux server · redhat/enterprise linux workstation · canonical/ubuntu linux · netapp/cn1610 firmware · netapp/aff baseboard management controller · netapp/cloud backup · netapp/data ontap edge · netapp/fas baseboard management controller · netapp/oncommand unified manager · netapp/ontap select deploy · netapp/service processor · netapp/steelstore cloud integrated storage · netapp/virtual storage console · netapp/clustered data ontap · netapp/data ontap · netapp/vasa provider · netapp/storage replication adapter · +2 more
- Source
- cve@mitre.org
EPSS 98.7% since 27 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
Public exploits (3)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
| EDB-ID | Title | Type | Published | Verified |
|---|---|---|---|---|
| EDB-45939source ↗ | OpenSSH < 7.7 - User Enumeration (2)linux · Leap Security | remote | 4 December 2018 | no |
| EDB-45233source ↗ | OpenSSH 2.3 < 7.7 - Username Enumerationlinux · Justin Gardner | remote | 21 August 2018 | yes |
| EDB-45210source ↗ | OpenSSH 2.3 < 7.7 - Username Enumeration (PoC)linux · Matthew Daley | remote | 16 August 2018 | yes |
References
- http://www.openwall.com/lists/oss-security/2018/08/15/5Mailing List, Patch, Third Party Advisory
- http://www.securityfocus.com/bid/105140Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041487Broken Link, Patch, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:0711Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2143Third Party Advisory
- https://bugs.debian.org/906236Issue Tracking, Mailing List, Patch, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfPatch, Third Party Advisory
- https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0Patch
- https://lists.debian.org/debian-lts-announce/2018/08/msg00022.htmlMailing List, Third Party Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0011Third Party Advisory
- https://security.gentoo.org/glsa/201810-03Third Party Advisory
- https://security.netapp.com/advisory/ntap-20181101-0001/Third Party Advisory
- https://usn.ubuntu.com/3809-1/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4280Third Party Advisory
- https://www.exploit-db.com/exploits/45210/Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/45233/Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/45939/Exploit, Third Party Advisory, VDB Entry
- https://www.oracle.com/security-alerts/cpujan2020.htmlPatch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2018/08/15/5Mailing List, Patch, Third Party Advisory
- http://www.securityfocus.com/bid/105140Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041487Broken Link, Patch, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:0711Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2143Third Party Advisory
- https://bugs.debian.org/906236Issue Tracking, Mailing List, Patch, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfPatch, Third Party Advisory
- https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0Patch
- https://lists.debian.org/debian-lts-announce/2018/08/msg00022.htmlMailing List, Third Party Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0011Third Party Advisory
- https://security.gentoo.org/glsa/201810-03Third Party Advisory
- https://security.netapp.com/advisory/ntap-20181101-0001/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.