{"id":"CVE-2018-15473","aliases":["ALPINE-CVE-2018-15473","BELL-CVE-2018-15473","DEBIAN-CVE-2018-15473","DLA-1474-1","DSA-4280-1","EUVD-2018-7351","GHSA-c8qw-h3f6-fv63","MGASA-2018-0363","RHSA-2019:0711","RHSA-2019:2143","SUSE-SU-2018:3540-1","SUSE-SU-2018:3686-1","SUSE-SU-2018:3768-1","SUSE-SU-2018:3776-1","SUSE-SU-2018:3776-2","SUSE-SU-2018:3781-1","SUSE-SU-2018:3910-1","UBUNTU-CVE-2018-15473","USN-3809-1","openSUSE-SU-2021:1383-1","openSUSE-SU-2021:1390-1","openSUSE-SU-2024:11407-1"],"status":"published","title":"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for...","description":"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.98675,"percentile":0.99924,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-362"],"published":"2018-08-17T00:00:00Z","modified":"2026-10-24T14:11:10Z","exploits":[{"source":"exploitdb","id":"EDB-45210","title":"OpenSSH 2.3 \u003c 7.7 - Username Enumeration (PoC)","type":"remote","platform":"linux","date":"2018-08-16","verified":true,"url":"https://www.exploit-db.com/exploits/45210"},{"source":"pocgithub","id":"trimstray/massh-enum","title":"trimstray/massh-enum","date":"2018-08-17","url":"https://github.com/trimstray/massh-enum"},{"source":"pocgithub","id":"gbonacini/opensshenum","title":"gbonacini/opensshenum","date":"2018-08-19","url":"https://github.com/gbonacini/opensshenum"},{"source":"exploitdb","id":"EDB-45233","title":"OpenSSH 2.3 \u003c 7.7 - Username Enumeration","type":"remote","platform":"linux","date":"2018-08-21","verified":true,"url":"https://www.exploit-db.com/exploits/45233"},{"source":"pocgithub","id":"Rhynorater/CVE-2018-15473-Exploit","title":"Rhynorater/CVE-2018-15473-Exploit","date":"2018-08-21","url":"https://github.com/Rhynorater/CVE-2018-15473-Exploit"},{"source":"pocgithub","id":"epi052/cve-2018-15473","title":"epi052/cve-2018-15473","date":"2018-10-03","url":"https://github.com/epi052/cve-2018-15473"},{"source":"pocgithub","id":"pyperanger/CVE-2018-15473_exploit","title":"pyperanger/CVE-2018-15473_exploit","date":"2018-10-08","url":"https://github.com/pyperanger/CVE-2018-15473_exploit"},{"source":"pocgithub","id":"r3dxpl0it/CVE-2018-15473","title":"r3dxpl0it/CVE-2018-15473","date":"2018-10-24","url":"https://github.com/r3dxpl0it/CVE-2018-15473"},{"source":"pocgithub","id":"JoeBlackSecurity/SSHUsernameBruter-SSHUB","title":"JoeBlackSecurity/SSHUsernameBruter-SSHUB","date":"2018-10-31","url":"https://github.com/JoeBlackSecurity/SSHUsernameBruter-SSHUB"},{"source":"exploitdb","id":"EDB-45939","title":"OpenSSH \u003c 7.7 - User Enumeration (2)","type":"remote","platform":"linux","date":"2018-12-04","url":"https://www.exploit-db.com/exploits/45939"},{"source":"pocgithub","id":"cved-sources/cve-2018-15473","title":"cved-sources/cve-2018-15473","date":"2019-01-11","url":"https://github.com/cved-sources/cve-2018-15473"},{"source":"pocgithub","id":"LINYIKAI/CVE-2018-15473-exp","title":"LINYIKAI/CVE-2018-15473-exp","date":"2019-01-23","url":"https://github.com/LINYIKAI/CVE-2018-15473-exp"},{"source":"pocgithub","id":"trickster1103/-","title":"trickster1103/-","date":"2019-06-19","url":"https://github.com/trickster1103/-"},{"source":"pocgithub","id":"NHPT/SSH-account-enumeration-verification-script","title":"NHPT/SSH-account-enumeration-verification-script","date":"2019-08-02","url":"https://github.com/NHPT/SSH-account-enumeration-verification-script"},{"source":"pocgithub","id":"CaioCGH/EP4-redes","title":"CaioCGH/EP4-redes","date":"2019-11-01","url":"https://github.com/CaioCGH/EP4-redes"},{"source":"pocgithub","id":"Moon1705/easy_security","title":"Moon1705/easy_security","date":"2020-05-08","url":"https://github.com/Moon1705/easy_security"},{"source":"pocgithub","id":"An0nYm0u5101/enumpossible","title":"An0nYm0u5101/enumpossible","date":"2020-08-03","url":"https://github.com/An0nYm0u5101/enumpossible"},{"source":"pocgithub","id":"Wh1t3Fox/cve-2018-15473","title":"Wh1t3Fox/cve-2018-15473","date":"2020-09-02","url":"https://github.com/Wh1t3Fox/cve-2018-15473"},{"source":"pocgithub","id":"1stPeak/CVE-2018-15473","title":"1stPeak/CVE-2018-15473","date":"2020-11-23","url":"https://github.com/1stPeak/CVE-2018-15473"},{"source":"pocgithub","id":"coollce/CVE-2018-15473_burte","title":"coollce/CVE-2018-15473_burte","date":"2020-11-26","url":"https://github.com/coollce/CVE-2018-15473_burte"},{"source":"pocgithub","id":"Dirty-Racoon/CVE-2018-15473-py3","title":"Dirty-Racoon/CVE-2018-15473-py3","date":"2020-11-27","url":"https://github.com/Dirty-Racoon/CVE-2018-15473-py3"},{"source":"pocgithub","id":"Sait-Nuri/CVE-2018-15473","title":"Sait-Nuri/CVE-2018-15473","date":"2020-11-29","url":"https://github.com/Sait-Nuri/CVE-2018-15473"},{"source":"pocgithub","id":"WildfootW/CVE-2018-15473_OpenSSH_7.7","title":"WildfootW/CVE-2018-15473_OpenSSH_7.7","date":"2020-12-09","url":"https://github.com/WildfootW/CVE-2018-15473_OpenSSH_7.7"},{"source":"pocgithub","id":"MrDottt/CVE-2018-15473","title":"MrDottt/CVE-2018-15473","date":"2021-09-14","url":"https://github.com/MrDottt/CVE-2018-15473"},{"source":"pocgithub","id":"0xrobiul/CVE-2018-15473","title":"0xrobiul/CVE-2018-15473","date":"2022-09-03","url":"https://github.com/0xrobiul/CVE-2018-15473"},{"source":"pocgithub","id":"philippedixon/CVE-2018-15473","title":"philippedixon/CVE-2018-15473","date":"2023-01-01","url":"https://github.com/philippedixon/CVE-2018-15473"},{"source":"pocgithub","id":"sergiovks/SSH-User-Enum-Python3-CVE-2018-15473","title":"sergiovks/SSH-User-Enum-Python3-CVE-2018-15473","date":"2023-03-09","url":"https://github.com/sergiovks/SSH-User-Enum-Python3-CVE-2018-15473"},{"source":"pocgithub","id":"Anonimo501/ssh_enum_users_CVE-2018-15473","title":"Anonimo501/ssh_enum_users_CVE-2018-15473","date":"2023-04-21","url":"https://github.com/Anonimo501/ssh_enum_users_CVE-2018-15473"},{"source":"metasploit","id":"auxiliary/scanner/ssh/ssh_enumusers","title":"SSH Username Enumeration","type":"auxiliary","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/ssh/ssh_enumusers"}],"exploits_more":16,"fixes":[{"ecosystem":"Alpine:v3.10","package":"openssh","fixed_in":["7.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"openssh","fixed_in":["7.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"openssh","fixed_in":["7.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"openssh","fixed_in":["7.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"openssh","fixed_in":["7.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"openssh","fixed_in":["7.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"openssh","fixed_in":["7.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openssh","fixed_in":["7.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openssh","fixed_in":["7.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openssh","fixed_in":["7.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openssh","fixed_in":["7.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openssh","fixed_in":["7.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssh","fixed_in":["7.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssh","fixed_in":["7.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssh","fixed_in":["7.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"openssh","fixed_in":["7.4_p1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"openssh","fixed_in":["7.5_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"openssh","fixed_in":["7.5_p1-r9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"openssh","fixed_in":["7.7_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"openssh","fixed_in":["7.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openssh","fixed_in":["1:7.7p1-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssh","fixed_in":["1:7.7p1-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssh","fixed_in":["1:7.7p1-4"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"openssh","fixed_in":["1:6.7p1-5+deb8u5"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"openssh","fixed_in":["1:7.4p1-10+deb9u4"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"openssh","fixed_in":["7.5p1-2.2.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-askpass","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-clients","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-debuginfo","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-server","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-ldap","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"pam_ssh_agent_auth","fixed_in":["0:0.9.3-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-clients","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-debuginfo","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-server","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-askpass","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-ldap","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"pam_ssh_agent_auth","fixed_in":["0:0.9.3-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-askpass","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-clients","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-debuginfo","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-server","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-ldap","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"pam_ssh_agent_auth","fixed_in":["0:0.9.3-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-askpass","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-clients","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-debuginfo","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-server","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-ldap","fixed_in":["0:5.3p1-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"pam_ssh_agent_auth","fixed_in":["0:0.9.3-124.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-askpass","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-clients","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-debuginfo","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-keycat","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-server","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-cavs","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-ldap","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-server-sysvinit","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"pam_ssh_agent_auth","fixed_in":["0:0.10.3-2.21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-clients","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-debuginfo","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-keycat","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-server","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-askpass","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-cavs","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-ldap","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-server-sysvinit","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"pam_ssh_agent_auth","fixed_in":["0:0.10.3-2.21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-askpass","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-clients","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-debuginfo","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-keycat","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-server","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-cavs","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-ldap","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-server-sysvinit","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"pam_ssh_agent_auth","fixed_in":["0:0.10.3-2.21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-askpass","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-clients","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-debuginfo","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-keycat","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-server","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-cavs","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-ldap","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-server-sysvinit","fixed_in":["0:7.4p1-21.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"pam_ssh_agent_auth","fixed_in":["0:0.10.3-2.21.el7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"openssh","fixed_in":["7.6p1-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"openssh-askpass-gnome","fixed_in":["7.6p1-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"openssh","fixed_in":["7.6p1-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"openssh-openssl1","fixed_in":["6.6p1-19.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openssh","fixed_in":["6.6p1-54.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openssh-askpass-gnome","fixed_in":["6.6p1-54.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openssh","fixed_in":["6.6p1-54.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openssh-askpass-gnome","fixed_in":["6.6p1-54.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh","fixed_in":["6.6p1-54.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh-askpass-gnome","fixed_in":["6.6p1-54.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"openssh","fixed_in":["6.6p1-36.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"openssh-askpass-gnome","fixed_in":["6.6p1-36.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"openssh","fixed_in":["6.6p1-36.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"openssh-askpass-gnome","fixed_in":["6.6p1-36.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"openssh","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openssh","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"openssh","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openssh","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"openssh","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"openssh","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openssh","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openssh","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"openssh","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openssh","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"openssh","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.30.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"openssh","fixed_in":["1:6.6p1-2ubuntu2.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"openssh","fixed_in":["1:7.2p2-4ubuntu2.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"openssh","fixed_in":["1:7.6p1-4ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"ssh-audit","fixed_in":["2.5.0-lp152.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"ssh-audit","fixed_in":["2.5.0-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"ssh-audit","fixed_in":["2.5.0-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ssh-audit","fixed_in":["2.5.0-1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4_p1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.7p1-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.7p1-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.7p1-4"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.7p1-5+deb8u5"}]}],"versions":["1:6.7p1-5","1:6.7p1-5+deb8u1","1:6.7p1-5+deb8u2","1:6.7p1-5+deb8u3","1:6.7p1-5+deb8u4"]},{"source":"osv","ecosystem":"Debian:9","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.4p1-10+deb9u4"}]}],"versions":["1:7.4p1-10","1:7.4p1-10+deb9u1","1:7.4p1-10+deb9u2","1:7.4p1-10+deb9u3"]},{"source":"osv","ecosystem":"Mageia:6","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5p1-2.2.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-124.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-2.21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-2.21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-2.21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-21.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-2.21.el7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.41.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.41.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.41.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.41.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.41.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.41.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"openssh-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-19.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.30.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.6p1-2ubuntu2.11"}]}],"versions":["1:6.2p2-6","1:6.2p2-6ubuntu1","1:6.4p1-1","1:6.4p1-2","1:6.5p1-1","1:6.5p1-2","1:6.5p1-3","1:6.5p1-4","1:6.5p1-6","1:6.6p1-1","1:6.6p1-2","1:6.6p1-2ubuntu1","1:6.6p1-2ubuntu2","1:6.6p1-2ubuntu2.2","1:6.6p1-2ubuntu2.3","1:6.6p1-2ubuntu2.4","1:6.6p1-2ubuntu2.6","1:6.6p1-2ubuntu2.7","1:6.6p1-2ubuntu2.8","1:6.6p1-2ubuntu2.10"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.6"}]}],"versions":["1:6.9p1-2","1:6.9p1-3","1:7.1p1-1","1:7.1p1-3","1:7.1p1-4","1:7.1p1-6","1:7.1p2-1","1:7.1p2-2","1:7.2p1-1","1:7.2p2-1","1:7.2p2-2","1:7.2p2-3","1:7.2p2-4","1:7.2p2-4ubuntu1","1:7.2p2-4ubuntu2.1","1:7.2p2-4ubuntu2.2","1:7.2p2-4ubuntu2.4","1:7.2p2-4ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-4ubuntu0.1"}]}],"versions":["1:7.5p1-10","1:7.6p1-4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.6p1-2ubuntu2.11"}]}],"versions":["1:6.2p2-6","1:6.2p2-6ubuntu1","1:6.4p1-1","1:6.4p1-2","1:6.5p1-1","1:6.5p1-2","1:6.5p1-3","1:6.5p1-4","1:6.5p1-6","1:6.6p1-1","1:6.6p1-2","1:6.6p1-2ubuntu1","1:6.6p1-2ubuntu2","1:6.6p1-2ubuntu2.2","1:6.6p1-2ubuntu2.3","1:6.6p1-2ubuntu2.4","1:6.6p1-2ubuntu2.6","1:6.6p1-2ubuntu2.7","1:6.6p1-2ubuntu2.8","1:6.6p1-2ubuntu2.10"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.6"}]}],"versions":["1:6.9p1-2","1:6.9p1-3","1:7.1p1-1","1:7.1p1-3","1:7.1p1-4","1:7.1p1-6","1:7.1p2-1","1:7.1p2-2","1:7.2p1-1","1:7.2p2-1","1:7.2p2-2","1:7.2p2-3","1:7.2p2-4","1:7.2p2-4ubuntu1","1:7.2p2-4ubuntu2.1","1:7.2p2-4ubuntu2.2","1:7.2p2-4ubuntu2.4","1:7.2p2-4ubuntu2.5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-4ubuntu0.1"}]}],"versions":["1:7.5p1-10","1:7.6p1-4"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"ssh-audit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"ssh-audit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"ssh-audit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ssh-audit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.2"}]}]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"netapp","product":"aff_baseboard_management_controller"},{"vendor":"netapp","product":"cloud_backup"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"netapp","product":"cn1610_firmware"},{"vendor":"netapp","product":"data_ontap"},{"vendor":"netapp","product":"data_ontap_edge"},{"vendor":"netapp","product":"fas_baseboard_management_controller"},{"vendor":"netapp","product":"oncommand_unified_manager"},{"vendor":"netapp","product":"ontap_select_deploy"},{"vendor":"netapp","product":"service_processor"},{"vendor":"netapp","product":"steelstore_cloud_integrated_storage"},{"vendor":"netapp","product":"storage_replication_adapter"},{"vendor":"netapp","product":"vasa_provider"},{"vendor":"netapp","product":"virtual_storage_console"},{"vendor":"openbsd","product":"openssh"},{"vendor":"oracle","product":"sun_zfs_storage_appliance_kit"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"siemens","product":"scalance_x204rna_firmware"}],"references":[{"url":"https://security.gentoo.org/glsa/201810-03","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1041487","tags":["vdb-entry","x_transferred","Broken Link","Patch","Third Party Advisory","VDB Entry","fix"]},{"url":"https://www.exploit-db.com/exploits/45233/","tags":["exploit","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://bugs.debian.org/906236","tags":["x_transferred","Issue Tracking","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://www.exploit-db.com/exploits/45210/","tags":["exploit","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://security.netapp.com/advisory/ntap-20181101-0001/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0","tags":["x_transferred","Patch","fix","report"]},{"url":"https://usn.ubuntu.com/3809-1/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/08/msg00022.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/105140","tags":["vdb-entry","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4280","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.exploit-db.com/exploits/45939/","tags":["exploit","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0011","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2018/08/15/5","tags":["x_transferred","Mailing List","Patch","Third Party Advisory","fix","report"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0711","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2143","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-15473","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20181101-0001"},{"url":"https://usn.ubuntu.com/3809-1"},{"url":"https://www.exploit-db.com/exploits/45210"},{"url":"https://www.exploit-db.com/exploits/45233"},{"url":"https://www.exploit-db.com/exploits/45939"},{"url":"https://github.com/advisories/GHSA-c8qw-h3f6-fv63"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-15473","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-15473","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-15473","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0363.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23452","tags":["report"]},{"url":"https://openwall.com/lists/oss-security/2018/08/15/5","tags":["web"]},{"url":"https://sekurak.pl/openssh-users-enumeration-cve-2018-15473/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1619063","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0711.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-15473","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-15473","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1583735","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1712053","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1722446","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2143.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183540-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1016370","tags":["report"]},{"url":"https://bugzilla.suse.com/1065000","tags":["report"]},{"url":"https://bugzilla.suse.com/1076957","tags":["report"]},{"url":"https://bugzilla.suse.com/1105010","tags":["report"]},{"url":"https://bugzilla.suse.com/1105180","tags":["report"]},{"url":"https://bugzilla.suse.com/1106163","tags":["report"]},{"url":"https://bugzilla.suse.com/1106726","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15473","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183686-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1081947","tags":["report"]},{"url":"https://bugzilla.suse.com/1091396","tags":["report"]},{"url":"https://bugzilla.suse.com/964336","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183768-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183776-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/982273","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183776-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183781-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183910-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-15473","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3809-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-10708","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HMNIMCAHIBHI4ABCI2JE3E6E2SYDAP2T/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/F33WEA5KQR7XFYMXJPGRCG4IZX75GFRO/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-15473","description":"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.","status":"published","published":"2018-08-17T00:00:00Z","modified":"2025-12-17T21:22:47.283Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:35:03.288698Z"}],"euvd":[{"id":"EUVD-2018-7351","description":"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.","status":"published","published":"2018-08-17T00:00:00Z","modified":"2025-12-17T21:22:47Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:03.481924Z"}],"ghsa":[{"id":"GHSA-c8qw-h3f6-fv63","title":"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for...","description":"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.","status":"published","published":"2022-05-13T01:19:10Z","modified":"2025-12-18T00:35:11Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:05:16.313648Z"}],"nvd":[{"id":"CVE-2018-15473","description":"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.","status":"published","published":"2018-08-17T19:29:00.223Z","modified":"2026-06-17T01:42:35.09Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:04:36.842579Z"}],"osv":[{"id":"ALPINE-CVE-2018-15473","description":"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.","status":"published","published":"2018-08-17T19:29:00.223Z","modified":"2026-10-23T17:17:55.221207729Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"BELL-CVE-2018-15473","title":"CVE-2018-15473 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:42.878809Z","modified":"2026-01-26T09:49:24.330809Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-15473","description":"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.","status":"published","published":"2018-08-17T19:29:00.223Z","modified":"2026-10-24T14:11:10.89476214Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:08.242347Z"},{"id":"DEBIAN-CVE-2018-15473","description":"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.","status":"published","published":"2018-08-17T19:29:00.223Z","modified":"2026-10-23T18:03:55.230353593Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"RHSA-2019:0711","title":"Red Hat Security Advisory: openssh security update","status":"published","published":"2024-09-16T02:10:15Z","modified":"2026-06-26T12:22:02.858421695Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2019:2143","title":"Red Hat Security Advisory: openssh security, bug fix, and enhancement update","status":"published","published":"2024-09-16T02:10:07Z","modified":"2026-06-26T12:22:03.694262427Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"UBUNTU-CVE-2018-15473","description":"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.","status":"published","published":"2018-08-17T00:00:00Z","modified":"2026-02-04T04:09:29.364288Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"DLA-1474-1","title":"openssh - security update","status":"published","published":"2018-08-21T00:00:00Z","modified":"2026-03-09T01:01:10.587175Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4280-1","title":"openssh - security update","status":"published","published":"2018-08-22T00:00:00Z","modified":"2026-03-09T02:08:46.543862Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0363","title":"Updated openssh packages fix security vulnerability","description":"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to\nnot delaying bailout for an invalid authenticating user until after the\npacket containing the request has been fully parsed, related to\nauth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c (CVE-2018-15473).\n","status":"published","published":"2018-08-31T21:11:59Z","modified":"2026-04-16T06:22:59.154970664Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2021:1383-1","title":"Security update for ssh-audit","description":"This update for ssh-audit fixes the following issues:\n\nssh-audit was updated to version 2.5.0\n\n* Fixed crash when running host key tests.\n* Handles server connection failures more gracefully.\n* Now prints JSON with indents when -jj is used (useful for\n  debugging).\n* Added MD5 fingerprints to verbose output.\n* Added -d/--debug option for getting debugging output.\n* Updated JSON output to include MD5 fingerprints. Note that\n  this results in a breaking change in the 'fingerprints'\n  dictionary format.\n* Updated OpenSSH 8.1 (and earlier) policies to include\n  rsa-sha2-512 and rsa-sha2-256.\n* Added OpenSSH v8.6 \u0026 v8.7 policies.\n* Added 3 new key exchanges:\n\n  + gss-gex-sha1-eipGX3TCiQSrx573bT1o1Q==\n  + gss-group1-sha1-eipGX3TCiQSrx573bT1o1Q==\n  + gss-group14-sha1-eipGX3TCiQSrx573bT1o1Q==\n* Added 3 new MACs:\n\n  + hmac-ripemd160-96\n  + AEAD_AES_128_GCM\n  + AEAD_AES_256_GCM\n\nUpdate to version 2.4.0\n\n* Added multi-threaded scanning support.\n* Added version check for OpenSSH user enumeration (CVE-2018-15473).\n* Added deprecation note to host key types based on SHA-1.\n* Added extra warnings for SSHv1.\n* Added built-in hardened OpenSSH v8.5 policy.\n* Upgraded warnings to failures for host key types based on SHA-1\n* Fixed crash when receiving unexpected response during host key\n  test.\n* Fixed hang against older Cisco devices during host key test \u0026\n  gex test.\n* Fixed improper termination while scanning multiple targets when\n  one target returns an error.\n* Dropped support for Python 3.5 (which reached EOL in Sept.2020)\n* Added 1 new key exchange: sntrup761x25519-sha512@openssh.com.\n\nUpdate to version 2.3.1\n\n* Now parses public key sizes for\n  rsa-sha2-256-cert-v01@openssh.com and\n  rsa-sha2-512-cert-v01@openssh.com host key types.\n* Flag ssh-rsa-cert-v01@openssh.com as a failure due to SHA-1\n  hash.\n* Fixed bug in recommendation output which suppressed some\n  algorithms inappropriately.\n* Built-in policies now include CA key requirements (if\n  certificates are in use).\n* Lookup function (--lookup) now performs case-insensitive\n  lookups of similar algorithms.\n* Migrated pre-made policies from external files to internal\n  database.\n* Split single 3,500 line script into many files (by class).\n* Added setup.py support\n* Added 1 new cipher: des-cbc@ssh.com.\n\nUpdate to version 2.3.0\n\nThe highlight of this release is support for policy scanning\n(this allows an admin to test a server against a\nhardened/standard configuration).\n\n* Added new policy auditing functionality to test adherence to\n  a hardening guide/standard configuration\n  (see -L/--list-policies, -M/--make-policy and -P/--policy).\n* Created new man page (see ssh-audit.1 file).\n* 1024-bit moduli upgraded from warnings to failures.\n* Many Python 2 code clean-ups, testing framework improvements,\n  pylint \u0026 flake8 fixes, and mypy type comments.\n* Added feature to look up algorithms in internal database\n  (see --lookup)\n* Suppress recommendation of token host key types.\n* Added check for use-after-free vulnerability in PuTTY v0.73.\n* Added 11 new host key types: ssh-rsa1, ssh-dss-sha256@ssh.com,\n  ssh-gost2001, ssh-gost2012-256, ssh-gost2012-512,\n  spki-sign-rsa, ssh-ed448, x509v3-ecdsa-sha2-nistp256,\n  x509v3-ecdsa-sha2-nistp384, x509v3-ecdsa-sha2-nistp521,\n  x509v3-rsa2048-sha256.\n* Added 8 new key exchanges: diffie-hellman-group1-sha256,\n  kexAlgoCurve25519SHA256, Curve25519SHA256, gss-group14-sha256-,\n  gss-group15-sha512-, gss-group16-sha512-, gss-nistp256-sha256-,\n  gss-curve25519-sha256-.\n* Added 5 new ciphers: blowfish, AEAD_AES_128_GCM,\n  AEAD_AES_256_GCM, crypticore128@ssh.com, seed-cbc@ssh.com.\n* Added 3 new MACs: chacha20-poly1305@openssh.com, hmac-sha3-224,\n  crypticore-mac@ssh.com.\n- Update ssh-audit.keyring\n","status":"published","published":"2021-10-18T14:06:46Z","modified":"2026-02-04T02:30:08.700583Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:1390-1","title":"Security update for ssh-audit","description":"This update for ssh-audit fixes the following issues:\n\nssh-audit was updated to version 2.5.0\n\n* Fixed crash when running host key tests.\n* Handles server connection failures more gracefully.\n* Now prints JSON with indents when -jj is used (useful for\n  debugging).\n* Added MD5 fingerprints to verbose output.\n* Added -d/--debug option for getting debugging output.\n* Updated JSON output to include MD5 fingerprints. Note that\n  this results in a breaking change in the 'fingerprints'\n  dictionary format.\n* Updated OpenSSH 8.1 (and earlier) policies to include\n  rsa-sha2-512 and rsa-sha2-256.\n* Added OpenSSH v8.6 \u0026 v8.7 policies.\n* Added 3 new key exchanges:\n\n  + gss-gex-sha1-eipGX3TCiQSrx573bT1o1Q==\n  + gss-group1-sha1-eipGX3TCiQSrx573bT1o1Q==\n  + gss-group14-sha1-eipGX3TCiQSrx573bT1o1Q==\n* Added 3 new MACs:\n\n  + hmac-ripemd160-96\n  + AEAD_AES_128_GCM\n  + AEAD_AES_256_GCM\n\nUpdate to version 2.4.0\n\n* Added multi-threaded scanning support.\n* Added version check for OpenSSH user enumeration (CVE-2018-15473).\n* Added deprecation note to host key types based on SHA-1.\n* Added extra warnings for SSHv1.\n* Added built-in hardened OpenSSH v8.5 policy.\n* Upgraded warnings to failures for host key types based on SHA-1\n* Fixed crash when receiving unexpected response during host key\n  test.\n* Fixed hang against older Cisco devices during host key test \u0026\n  gex test.\n* Fixed improper termination while scanning multiple targets when\n  one target returns an error.\n* Dropped support for Python 3.5 (which reached EOL in Sept.2020)\n* Added 1 new key exchange: sntrup761x25519-sha512@openssh.com.\n\n","status":"published","published":"2021-10-20T18:07:44Z","modified":"2026-02-04T04:37:06.928768Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11407-1","title":"ssh-audit-2.5.0-1.2 on GA media","description":"These are all security issues fixed in the ssh-audit-2.5.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:18:01.295078Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:3540-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such a username enumeration (or 'oracle') as a vulnerability. (bsc#1106163)\n- CVE-2017-15906: The process_open function in sftp-server.c in OpenSSH did not properly prevent write operations in readonly mode, which allowed attackers to create zero-length files. (bsc#1065000, bsc#1106726)\n- CVE-2016-10708: sshd allowed remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c.  (bsc#1076957)\n- CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (bsc#1105010)\n- CVE-2016-10012: Removed pre-auth compression support from the server to prevent possible cryptographic attacks.  (bsc#1016370)\n\nBugs fixed:\n\n- Fixed failing 'AuthorizedKeysCommand' within a 'Match User' block in sshd_config (bsc#1105180)\n","status":"published","published":"2018-10-29T05:47:11Z","modified":"2026-02-04T03:29:27.07426Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3686-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\n- CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such a username enumeration (or 'oracle') as a vulnerability. (bsc#1106163)\n- CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (bsc#1105010)\n\nThe following non-security issues were fixed:\n\n- Stop leaking File descriptors (bsc#964336)\n- sftp-client.c returns wrong error code upon failure (bsc#1091396)\n- added pam_keyinit to pam configuration file (bsc#1081947)\n\n","status":"published","published":"2018-11-08T16:56:57Z","modified":"2026-02-04T03:48:46.850068Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3768-1","title":"Security update for openssh-openssl1","description":"This update for openssh-openssl1 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such a username enumeration (or 'oracle') as a vulnerability. (bsc#1106163)\n- CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (bsc#1105010)\n\nFollowing non-security issues were fixed:\n\n- Fix for sftp client because it returns wrong error code upon failure (bsc#1091396)\n- Stop leaking File descriptors (bsc#964336)\n","status":"published","published":"2018-11-14T13:16:30Z","modified":"2026-02-04T02:45:24.632645Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3776-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nFollowing security issues have been fixed:\n\n- CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such a username enumeration (or 'oracle') as a vulnerability. (bsc#1106163)\n- CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (bsc#1105010)\n\nAlso the following security related hardening change was done:\n\n- Remove arcfour,cast,blowfish from list of default ciphers. (bsc#982273)\n\nAnd the following non-security issues were fixed:\n\n- Stop leaking File descriptors (bsc#964336)\n- sftp-client.c returns wrong error code upon failure (bsc#1091396)\n","status":"published","published":"2018-11-16T15:02:20Z","modified":"2026-02-04T02:39:52.479454Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3776-2","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nFollowing security issues have been fixed:\n\n- CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such a username enumeration (or 'oracle') as a vulnerability. (bsc#1106163)\n- CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (bsc#1105010)\n\nAlso the following security related hardening change was done:\n\n- Remove arcfour,cast,blowfish from list of default ciphers. (bsc#982273)\n\nAnd the following non-security issues were fixed:\n\n- Stop leaking File descriptors (bsc#964336)\n- sftp-client.c returns wrong error code upon failure (bsc#1091396)\n","status":"published","published":"2019-04-29T06:09:11Z","modified":"2025-05-02T04:07:50.87649Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3781-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nFollowing security issues have been fixed:\n\n- CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such a username enumeration (or 'oracle') as a vulnerability. (bsc#1106163)\n- CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (bsc#1105010)\n\nAlso the following security related hardening change was done:\n\n- Removed arcfour,blowfish,cast from list of default ciphers as they are long discontinued and should no longer be used. (bsc#982273)\n\nAnd the following non-security issues were fixed:\n\n- Stop leaking File descriptors (bsc#964336)\n- sftp-client.c returns wrong error code upon failure (bsc#1091396)\n\n","status":"published","published":"2018-11-16T15:03:11Z","modified":"2026-02-04T02:17:07.671831Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3910-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nFollowing security issues have been fixed:\n\n- CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (bsc#1105010)\n\nThe following non-security issues were fixed:\n\n- Stop leaking File descriptors (bsc#964336)\n- sftp-client.c returns wrong error code upon failure [bsc#1091396]\n\n","status":"published","published":"2018-11-26T16:47:54Z","modified":"2026-02-04T02:29:10.944419Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"USN-3809-1","title":"openssh vulnerabilities","description":"Robert Swiecki discovered that OpenSSH incorrectly handled certain messages.\nAn attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.\n(CVE-2016-10708)\n\nIt was discovered that OpenSSH incorrectly handled certain requests.\nAn attacker could possibly use this issue to access sensitive information.\n(CVE-2018-15473)\n","status":"published","published":"2018-11-06T13:21:08Z","modified":"2026-05-04T09:39:35.802709Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}