OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade openssh | Sep 21, 2018 | Aug 17, 2018 |
| Amazon Linux Ami 2 | — | Upgrade pam_ssh_agent_authUpgrade openssh-server-sysvinitUpgrade openssh-serverUpgrade openssh-keycatUpgrade opensshUpgrade openssh-askpassUpgrade openssh-clientsUpgrade openssh-cavsUpgrade openssh-debuginfoUpgrade openssh-ldap | Apr 27, 2020 | Aug 17, 2018 |
| Amazon_linux | — | Upgrade openssh | Sep 7, 2018 | Aug 17, 2018 |
| Centos_linux | — | Upgrade openssh-ldapUpgrade openssh-keycatUpgrade pam_ssh_agent_authUpgrade openssh-server-sysvinitUpgrade openssh-debuginfoUpgrade openssh-askpassUpgrade opensshUpgrade openssh-clientsUpgrade openssh-serverUpgrade openssh-cavs | Apr 13, 2019 | Aug 17, 2018 |
| Debian | — | Upgrade openssh | Aug 24, 2018 | Aug 17, 2018 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | Oct 9, 2018 | Aug 17, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade openssh-serverUpgrade openssh-askpassUpgrade openssh-keycatUpgrade opensshUpgrade openssh-clients | Dec 31, 2018 | Aug 17, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade openssh-keycatUpgrade openssh-clientsUpgrade opensshUpgrade openssh-serverUpgrade openssh-askpass | Dec 11, 2018 | Aug 17, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade openssh-keycatUpgrade opensshUpgrade openssh-clientsUpgrade openssh-askpassUpgrade openssh-server | Jan 9, 2019 | Aug 17, 2018 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory12 | Oct 25, 2018 | Aug 17, 2018 |
| Openbsd Openssh | — | Upgrade to the latest version of OpenSSH | Oct 18, 2018 | Aug 17, 2018 |
| Oracle Solaris | — | Upgrade network/ssh to version 7.7.0.1-11.4.6.0.1.2.0 on Solaris 11.4Upgrade service/network/ssh to version 7.7.0.1-11.4.6.0.1.2.0 on Solaris 11.4 | Feb 20, 2019 | Aug 17, 2018 |
| Oracle_linux | — | Upgrade openssh-keycatUpgrade openssh-clientsUpgrade openssh-server-sysvinitUpgrade openssh-serverUpgrade openssh-ldapUpgrade opensshUpgrade openssh-cavsUpgrade openssh-askpassUpgrade pam_ssh_agent_auth | Apr 10, 2019 | Aug 16, 2018 |
| Redhat_linux | — | Upgrade openssh-askpassUpgrade openssh-ldapUpgrade opensshUpgrade openssh-debuginfoUpgrade pam_ssh_agent_authUpgrade openssh-keycatUpgrade openssh-serverUpgrade openssh-cavsUpgrade openssh-clientsUpgrade openssh-server-sysvinit | Apr 15, 2019 | Aug 17, 2018 |
| Suse | — | Upgrade opensshUpgrade ssh-auditUpgrade openssh-askpassUpgrade openssh-askpass-gnomeUpgrade openssh-openssl1-helpersUpgrade openssh-helpersUpgrade openssh-cavsUpgrade openssh-fipsUpgrade openssh-openssl1 | Oct 30, 2018 | Aug 17, 2018 |
| Ubuntu | — | Upgrade openssh-server | Nov 13, 2018 | Aug 17, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 17, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub