CVE-2018-15473

Publication date 17 August 2018

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openssh	21.04 hirsute	Not affected
	20.10 groovy	Not affected
	20.04 LTS focal	Not affected
	19.10 eoan	Not affected
	19.04 disco	Not affected
	18.10 cosmic	Fixed 1:7.7p1-4
	18.04 LTS bionic	Fixed 1:7.6p1-4ubuntu0.1
	16.04 LTS xenial	Fixed 1:7.2p2-4ubuntu2.6
	14.04 LTS trusty	Fixed 1:6.6p1-2ubuntu2.11
openssh-ssh1	21.04 hirsute	Not affected
	20.10 groovy	Not affected
	20.04 LTS focal	Not affected
	19.10 eoan	Not affected
	19.04 disco	Not affected
	18.10 cosmic	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release

Notes

seth-arnold

openssh-ssh1 is provided for compatibility with old devices that cannot be upgraded to modern protocols. Thus we may not provide security support for this package if doing so would prevent access to equipment. openssh-ssh1 is a *client-only* package, no server-side facility, so there is no path to leak data

mdeslaur

watch for regressions, see debian ELA-37-3

leosilva

for openss, cosmic is not affected, and so disco too.

Severity score breakdown

Parameter	Value
Base score	5.3 · Medium
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity impact	None
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

Related Ubuntu Security Notices (USN)

USN-3809-1
OpenSSH vulnerabilities
6 November 2018