{"id":"CVE-2007-2768","aliases":["AZL-35079","AZL-6778","DEBIAN-CVE-2007-2768","EUVD-2007-2760","GHSA-7c33-39g7-9rjm"],"status":"published","title":"OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to...","description":"OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.08615,"percentile":0.95131,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2007-05-21T20:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"openssh","fixed_in":["9.5p1-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"openssh","fixed_in":["8.8p1-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5p1-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8p1-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0p1-1","1:10.0p1-2","1:10.0p1-3","1:10.0p1-4","1:10.0p1-5","1:10.0p1-5~bpo12+2","1:10.0p1-6","1:10.0p1-7","1:10.0p1-7~bpo12+1","1:10.0p1-8","1:10.1p1-1","1:10.1p1-2","1:10.2p1-1","1:10.2p1-2","1:10.2p1-2~bpo13+1","1:10.2p1-3","1:10.2p1-4","1:10.2p1-5","1:10.2p1-6","1:10.2p1-6~bpo13+1","1:10.3p1-1","1:10.3p1-1~bpo13+1","1:10.3p1-2","1:10.3p1-3","1:10.3p1-4","1:10.3p1-5","1:10.3p1-7","1:10.3p1-8","1:10.3p1-9","1:10.4p1-1","1:10.4p1-2","1:10.4p1-3","1:10.4p1-4","1:10.4p1-5","1:10.5p1-1","1:10.6p1-1","1:9.2p1-2","1:9.2p1-2+deb12u1","1:9.2p1-2+deb12u10","1:9.2p1-2+deb12u2","1:9.2p1-2+deb12u3","1:9.2p1-2+deb12u4","1:9.2p1-2+deb12u5","1:9.2p1-2+deb12u6","1:9.2p1-2+deb12u7","1:9.2p1-2+deb12u8","1:9.2p1-2+deb12u9","1:9.3p1-1","1:9.3p1-1+loong64","1:9.3p2-1","1:9.4p1-1","1:9.5p1-1","1:9.5p1-2","1:9.6p1-1","1:9.6p1-2","1:9.6p1-3","1:9.6p1-4","1:9.6p1-5","1:9.7p1-1","1:9.7p1-2","1:9.7p1-3","1:9.7p1-3+hurd.1","1:9.7p1-4","1:9.7p1-5","1:9.7p1-6","1:9.7p1-7","1:9.8p1-1","1:9.8p1-2","1:9.8p1-3","1:9.8p1-4","1:9.8p1-7","1:9.8p1-8","1:9.9p1-1","1:9.9p1-2","1:9.9p1-3","1:9.9p1-3+hurd.1","1:9.9p2-1","1:9.9p2-2"]},{"source":"osv","ecosystem":"Debian:13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0p1-7","1:10.0p1-7+deb13u1","1:10.0p1-7+deb13u2","1:10.0p1-7+deb13u3","1:10.0p1-7+deb13u4","1:10.0p1-8","1:10.1p1-1","1:10.1p1-2","1:10.2p1-1","1:10.2p1-2","1:10.2p1-2~bpo13+1","1:10.2p1-3","1:10.2p1-4","1:10.2p1-5","1:10.2p1-6","1:10.2p1-6~bpo13+1","1:10.3p1-1","1:10.3p1-1~bpo13+1","1:10.3p1-2","1:10.3p1-3","1:10.3p1-4","1:10.3p1-5","1:10.3p1-7","1:10.3p1-8","1:10.3p1-9","1:10.4p1-1","1:10.4p1-2","1:10.4p1-3","1:10.4p1-4","1:10.4p1-5","1:10.5p1-1","1:10.6p1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0p1-7","1:10.0p1-8","1:10.1p1-1","1:10.1p1-2","1:10.2p1-1","1:10.2p1-2","1:10.2p1-2~bpo13+1","1:10.2p1-3","1:10.2p1-4","1:10.2p1-5","1:10.2p1-6","1:10.2p1-6~bpo13+1","1:10.3p1-1","1:10.3p1-1~bpo13+1","1:10.3p1-2","1:10.3p1-3","1:10.3p1-4","1:10.3p1-5","1:10.3p1-7","1:10.3p1-8","1:10.3p1-9","1:10.4p1-1","1:10.4p1-2","1:10.4p1-3","1:10.4p1-4","1:10.4p1-5","1:10.5p1-1","1:10.6p1-1"]}],"products":[{"vendor":"netapp","product":"hci_management_node"},{"vendor":"netapp","product":"hci_storage_node"},{"vendor":"netapp","product":"solidfire"},{"vendor":"netapp","product":"steelstore_cloud_integrated_storage"},{"vendor":"openbsd","product":"openssh"}],"references":[{"url":"http://www.osvdb.org/34601","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Broken Link","web"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2007-04/0635.html","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Broken Link","web"]},{"url":"https://security.netapp.com/advisory/ntap-20191107-0002/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-2768","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20191107-0002"},{"url":"https://github.com/advisories/GHSA-7c33-39g7-9rjm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2007-2768","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2007-2768","description":"OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.","status":"published","published":"2007-05-21T20:00:00Z","modified":"2024-08-07T13:49:57.388Z","updated_at":"2026-11-02T13:32:34.372976Z"}],"euvd":[{"id":"EUVD-2007-2760","description":"OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.","status":"published","published":"2007-05-21T20:00:00Z","modified":"2024-08-07T13:49:57Z","updated_at":"2026-11-03T01:38:19.624156Z"}],"ghsa":[{"id":"GHSA-7c33-39g7-9rjm","title":"OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to...","description":"OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.","status":"published","published":"2022-05-01T18:06:58Z","modified":"2025-04-09T03:42:51Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:00:53.859901Z"}],"nvd":[{"id":"CVE-2007-2768","description":"OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.","status":"published","published":"2007-05-21T20:30:00Z","modified":"2026-06-16T22:40:16.857Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:01:16.479378Z"}],"osv":[{"id":"AZL-35079","title":"CVE-2007-2768 affecting package openssh for versions less than 9.5p1-2","description":"OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.","status":"published","published":"2007-05-21T20:30:00Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"AZL-6778","title":"CVE-2007-2768 affecting package openssh for versions less than 8.8p1-2","description":"OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.","status":"published","published":"2007-05-21T20:30:00Z","modified":"2026-04-21T04:38:15.948261Z","updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"CVE-2007-2768","description":"OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.","status":"published","published":"2007-05-21T20:30:00Z","modified":"2026-04-10T03:38:53.81426Z","updated_at":"2026-11-02T15:43:56.865964Z"},{"id":"DEBIAN-CVE-2007-2768","description":"OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.","status":"published","published":"2007-05-21T20:30:00Z","modified":"2026-10-21T17:47:41.121065326Z","updated_at":"2026-11-02T15:45:23.411908Z"}]}}