CVE-2018-15599

NONE EPSS 84.1%

Published Aug 21, 20187y ago · Modified Jun 17, 20262w ago

Published Aug 21, 2018 7y ago

Last Modified Jun 17, 2026 2w ago

Description

The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase.

Threat Intelligence

EPSS Exploit Probability

84.1% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure

Affected Products 2

Vendor	Product	Version	Range
debian	debian_linux	8.0	any
dropbear_ssh_project	dropbear_ssh	*	≤2018.76

References 5

lists.ucc.gu.uwa.edu.au http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2018q3/002108.html

Mailing ListThird Party Advisory
lists.ucc.gu.uwa.edu.au http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2018q3/002109.html

Mailing ListThird Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2018/08/msg00026.html

Mailing ListThird Party Advisory
matt.ucc.asn.au https://matt.ucc.asn.au/dropbear/CHANGES
old.reddit.com https://old.reddit.com/r/blackhat/comments/97ywnm/openssh_username_enumeration/e4e05n2/

Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.