CVE-2017-2659 It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI authentication failure was incorrectly cou...
HighCVSS 7.5
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI authentication failure was incorrectly counted towards the maximum allowed number of password attempts.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/dropbear(Debian:12) | < 2013.60-1 | 2013.60-1 |
| debian/dropbear(Debian:13) | < 2013.60-1 | 2013.60-1 |
| debian/dropbear(Debian:14) | < 2013.60-1 | 2013.60-1 |
| dropbear ssh project dropbear ssh | < 2013.59 | 2013.59 |
| [UNKNOWN] dropbear | = fixed in 2013.59 | No fix listed |
References
- Debian Security Tracker CVE-2017-2659 vendor-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- secure.ucc.asn.au patch third-party-advisory