OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-openssh | Sep 21, 2018 | Aug 17, 2018 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-opensshamazon-linux-ami-2-upgrade-openssh-askpassamazon-linux-ami-2-upgrade-openssh-cavsamazon-linux-ami-2-upgrade-openssh-clientsamazon-linux-ami-2-upgrade-openssh-debuginfoamazon-linux-ami-2-upgrade-openssh-keycatamazon-linux-ami-2-upgrade-openssh-ldapamazon-linux-ami-2-upgrade-openssh-serveramazon-linux-ami-2-upgrade-openssh-server-sysvinitamazon-linux-ami-2-upgrade-pam_ssh_agent_auth | Apr 27, 2020 | Aug 17, 2018 | |
| Amazon_linux | — | amazon-linux-upgrade-openssh | Sep 7, 2018 | Aug 17, 2018 |
| Centos_linux | — | centos-upgrade-opensshcentos-upgrade-openssh-askpasscentos-upgrade-openssh-cavscentos-upgrade-openssh-clientscentos-upgrade-openssh-debuginfocentos-upgrade-openssh-keycatcentos-upgrade-openssh-ldapcentos-upgrade-openssh-servercentos-upgrade-openssh-server-sysvinitcentos-upgrade-pam_ssh_agent_auth | Apr 13, 2019 | Aug 17, 2018 |
| Debian | debian-upgrade-openssh | Aug 24, 2018 | Aug 17, 2018 | |
| Gentoo Linux | gentoo-linux-upgrade-net-misc-openssh | Oct 9, 2018 | Aug 17, 2018 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-opensshhuawei-euleros-2_0_sp2-upgrade-openssh-askpasshuawei-euleros-2_0_sp2-upgrade-openssh-clientshuawei-euleros-2_0_sp2-upgrade-openssh-keycathuawei-euleros-2_0_sp2-upgrade-openssh-server | Dec 31, 2018 | Aug 17, 2018 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-opensshhuawei-euleros-2_0_sp3-upgrade-openssh-askpasshuawei-euleros-2_0_sp3-upgrade-openssh-clientshuawei-euleros-2_0_sp3-upgrade-openssh-keycathuawei-euleros-2_0_sp3-upgrade-openssh-server | Dec 11, 2018 | Aug 17, 2018 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-opensshhuawei-euleros-2_0_sp5-upgrade-openssh-askpasshuawei-euleros-2_0_sp5-upgrade-openssh-clientshuawei-euleros-2_0_sp5-upgrade-openssh-keycathuawei-euleros-2_0_sp5-upgrade-openssh-server | Jan 9, 2019 | Aug 17, 2018 | |
| Ibm Aix | ibm-aix-openssh_advisory12 | Oct 25, 2018 | Aug 17, 2018 | |
| Openbsd Openssh | openbsd-openssh-upgrade-latest | Oct 18, 2018 | Aug 17, 2018 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-network-ssh-7-7-0-1-11-4-6-0-1-2-0oracle-solaris-11-4-upgrade-service-network-ssh-7-7-0-1-11-4-6-0-1-2-0 | Feb 20, 2019 | Aug 17, 2018 | |
| Oracle_linux | — | oracle-linux-upgrade-opensshoracle-linux-upgrade-openssh-askpassoracle-linux-upgrade-openssh-cavsoracle-linux-upgrade-openssh-clientsoracle-linux-upgrade-openssh-keycatoracle-linux-upgrade-openssh-ldaporacle-linux-upgrade-openssh-serveroracle-linux-upgrade-openssh-server-sysvinitoracle-linux-upgrade-pam-ssh-agent-auth | Apr 10, 2019 | Aug 16, 2018 |
| Redhat_linux | — | redhat-upgrade-opensshredhat-upgrade-openssh-askpassredhat-upgrade-openssh-cavsredhat-upgrade-openssh-clientsredhat-upgrade-openssh-debuginforedhat-upgrade-openssh-keycatredhat-upgrade-openssh-ldapredhat-upgrade-openssh-serverredhat-upgrade-openssh-server-sysvinitredhat-upgrade-pam_ssh_agent_auth | Apr 15, 2019 | Aug 17, 2018 |
| Suse | — | suse-upgrade-opensshsuse-upgrade-openssh-askpasssuse-upgrade-openssh-askpass-gnomesuse-upgrade-openssh-cavssuse-upgrade-openssh-fipssuse-upgrade-openssh-helperssuse-upgrade-openssh-openssl1suse-upgrade-openssh-openssl1-helperssuse-upgrade-ssh-audit | Oct 30, 2018 | Aug 17, 2018 |
| Ubuntu | ubuntu-upgrade-openssh-server | Nov 13, 2018 | Aug 17, 2018 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Aug 17, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub