CVE-2019-12953
Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing...
CVE-2019-12953 is a medium vulnerability (CVSS 5.3) in Dropbear Ssh Project Ssh, published December 30, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.24%, the 69th percentile. Fixed in dropbear 2019.78-1.
Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-2018-15599.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-2018-15599.
- Record
CVE-2019-12953- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
CVE List No score
Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-2018-15599.
- Record
CVE-2019-12953- Updated
- 2026-11-02
EUVDEUVD-2019-4528 No score
Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-2018-15599.
- Record
EUVD-2019-4528- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6hj9-w8vp-p698 No score
Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing...
Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-2018-15599.
- Record
GHSA-6hj9-w8vp-p698- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-2018-15599.
- Record
CVE-2019-12953- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-12953
Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-2018-15599.
- Record
DEBIAN-CVE-2019-12953- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-12953
Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-2018-15599.
- Record
UBUNTU-CVE-2019-12953- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dropbearDebian:12 |
before 2019.78-1 | 2019.78-1 |
dropbearDebian:13 |
before 2019.78-1 | 2019.78-1 |
dropbearDebian:14 |
before 2019.78-1 | 2019.78-1 |
dropbearUbuntu:16.04:LTS |
All versions, plus listed versions 2014.65-1ubuntu22015.68-12015.70-12015.71-12016.72-1 |
None known |
dropbearUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2017.75-22017.75-3build12017.75-3ubuntu0.1~esm1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |