CVE-2018-15919
Medium
Description
Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability.'
SeverityMedium
CVSS5.3
Exploit probability—
ProductOpenbsd Openssh
PublishedAug 28, 2018
First seenAug 28, 2018
Weakness typeCWE-200Sensitive information exposure
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openbsd openssh | 5.9 ≤ v ≤ 7.8 | — |
| netapp cloud_backup | No range specified | — |
| netapp data_ontap_edge | No range specified | — |
| netapp ontap_select_deploy | No range specified | — |
| netapp steelstore | No range specified | — |
| netapp cn1610_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.