CVE-2018-15919 Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states '...
MediumCVSS 5.3
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability.'
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openssh(Debian:12) | All versions | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-3 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-4 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-5 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-5~bpo12+2 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-6 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-7 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-7~bpo12+1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-8 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.1p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.1p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.2p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.2p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.2p1-2~bpo13+1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.2p1-3 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.2p1-4 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.2p1-5 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.2p1-6 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.2p1-6~bpo13+1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.3p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.3p1-1~bpo13+1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.3p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.3p1-3 | No fix listed |
Show 122 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openssh(Debian:12) | = 1:10.3p1-4 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.3p1-5 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.3p1-7 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.3p1-8 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.3p1-9 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.4p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.4p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.4p1-3 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.4p1-4 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.4p1-5 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.5p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.6p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u10 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u2 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u3 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u4 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u5 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u6 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u7 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u8 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u9 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.3p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.3p1-1+loong64 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.3p2-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.4p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.5p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.5p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.6p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.6p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.6p1-3 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.6p1-4 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.6p1-5 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.7p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.7p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.7p1-3 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.7p1-3+hurd.1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.7p1-4 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.7p1-5 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.7p1-6 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.7p1-7 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.8p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.8p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.8p1-3 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.8p1-4 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.8p1-7 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.8p1-8 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.9p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.9p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.9p1-3 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.9p1-3+hurd.1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.9p2-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.9p2-2 | No fix listed |
| debian/openssh(Debian:13) | All versions | No fix listed |
| debian/openssh(Debian:13) | = 1:10.0p1-7 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.0p1-7+deb13u1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.0p1-7+deb13u2 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.0p1-7+deb13u3 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.0p1-7+deb13u4 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.0p1-8 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.1p1-1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.1p1-2 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.2p1-1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.2p1-2 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.2p1-2~bpo13+1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.2p1-3 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.2p1-4 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.2p1-5 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.2p1-6 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.2p1-6~bpo13+1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.3p1-1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.3p1-1~bpo13+1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.3p1-2 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.3p1-3 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.3p1-4 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.3p1-5 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.3p1-7 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.3p1-8 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.3p1-9 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.4p1-1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.4p1-2 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.4p1-3 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.4p1-4 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.4p1-5 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.5p1-1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.6p1-1 | No fix listed |
| debian/openssh(Debian:14) | All versions | No fix listed |
| debian/openssh(Debian:14) | = 1:10.0p1-7 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.0p1-8 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.1p1-1 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.1p1-2 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.2p1-1 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.2p1-2 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.2p1-2~bpo13+1 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.2p1-3 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.2p1-4 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.2p1-5 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.2p1-6 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.2p1-6~bpo13+1 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.3p1-1 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.3p1-1~bpo13+1 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.3p1-2 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.3p1-3 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.3p1-4 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.3p1-5 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.3p1-7 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.3p1-8 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.3p1-9 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.4p1-1 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.4p1-2 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.4p1-3 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.4p1-4 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.4p1-5 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.5p1-1 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.6p1-1 | No fix listed |
| OpenBSD openssh | >= 5.9, <= 7.8 | No fix listed |
| netapp cloud backup | All versions | No fix listed |
| netapp data ontap edge | All versions | No fix listed |
| netapp ontap select deploy | All versions | No fix listed |
| netapp steelstore | All versions | No fix listed |
| netapp cn1610 firmware | All versions | No fix listed |
References
- Debian Security Tracker CVE-2018-15919 vendor-advisory
- seclists.org mailing-list patch third-party-advisory
- 105163 third-party-advisory vdb-entry
- security.netapp.com third-party-advisory
- bugs.debian.org issue-tracking