This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-15473 →

DEBIAN-CVE-2018-15473

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet...

Original description

The description as published by the source.

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 openssh

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.7p1-4"}]}]

Debian:13 openssh

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.7p1-4"}]}]

Debian:14 openssh

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.7p1-4"}]}]

References

advisory security-tracker.debian.org