CVE-2018-15473
17.08.2018, 19:29
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
| Vendor | Product | Version |
|---|---|---|
| openbsd | openssh | 𝑥 ≤ 7.7 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 9.0 |
| redhat | enterprise_linux_desktop | 6.0 |
| redhat | enterprise_linux_desktop | 7.0 |
| redhat | enterprise_linux_server | 6.0 |
| redhat | enterprise_linux_server | 7.0 |
| redhat | enterprise_linux_workstation | 6.0 |
| redhat | enterprise_linux_workstation | 7.0 |
| canonical | ubuntu_linux | 14.04 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 18.04 |
| netapp | cn1610_firmware | - |
| netapp | aff_baseboard_management_controller | - |
| netapp | cloud_backup | - |
| netapp | data_ontap_edge | - |
| netapp | fas_baseboard_management_controller | - |
| netapp | oncommand_unified_manager | 9.4 ≤ |
| netapp | ontap_select_deploy | - |
| netapp | service_processor | - |
| netapp | steelstore_cloud_integrated_storage | - |
| netapp | virtual_storage_console | 7.2 ≤ |
| netapp | clustered_data_ontap | - |
| netapp | data_ontap | - |
| netapp | vasa_provider | 7.2 ≤ |
| netapp | storage_replication_adapter | 7.2 ≤ |
| oracle | sun_zfs_storage_appliance_kit | 8.8.6 |
| siemens | scalance_x204rna_firmware | 𝑥 < 3.2.7 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| openssh |
| ||||||||||||||||||
| openssh-ssh1 |
|
References