CVE-2018-15919

EUVD-2018-7775
Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability.'
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA-ADPADP
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 83%
Affected Products (NVD)
VendorProductVersion
openbsdopenssh
5.9 ≤
𝑥
≤ 7.8
netappcloud_backup
-
netappdata_ontap_edge
-
netappontap_select_deploy
-
netappsteelstore
-
netappcn1610_firmware
-
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
openssh
bookworm
unimportant
bookworm (security)
unimportant
bullseye
unimportant
bullseye (security)
unimportant
sid
unimportant
trixie
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
openssh
bionic
ignored
cosmic
ignored
disco
ignored
eoan
ignored
focal
ignored
trusty
ignored
xenial
ignored
openssh-ssh1
bionic
ignored
cosmic
ignored
disco
ignored
eoan
ignored
focal
ignored
trusty
dne
xenial
dne
Common Weakness Enumeration
References
http://seclists.org/oss-sec/2018/q3/180
http://www.securityfocus.com/bid/105163
https://security.netapp.com/advisory/ntap-20181221-0001/
http://seclists.org/oss-sec/2018/q3/180
http://www.securityfocus.com/bid/105163
https://security.netapp.com/advisory/ntap-20181221-0001/