CVE-2018-15473 json
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after…
published 2018-08-17 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-7351
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 98.7%
- EPSS 98.7% chance of exploitation in 30 days, percentile 99.9%
- public exploits
- 4
- Metasploit, Exploit-DB
Summary
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
Patch / fix
- siemens scalance_x204rna_firmware 3.2.7
- openssh Debian 14, Debian 13, Debian 12 1:7.7p1-4
debian advisories DEBIAN-CVE-2018-15473
- openssh Ubuntu 14.04 LTS 1:6.6p1-2ubuntu2.11
- openssh Ubuntu 16.04 LTS 1:7.2p2-4ubuntu2.6
- openssh Ubuntu 18.04 LTS 1:7.6p1-4ubuntu0.1
ubuntu advisories UBUNTU-CVE-2018-15473
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- openssh RHEL 6 5.3p1-124.el6_10
- openssh-ldap RHEL 6 5.3p1-124.el6_10
- openssh-server RHEL 6 5.3p1-124.el6_10
- openssh-askpass RHEL 6 5.3p1-124.el6_10
- openssh-clients RHEL 6 5.3p1-124.el6_10
- pam_ssh_agent_auth RHEL 6 0.9.3-124.el6_10
- openssh RHEL 7 7.4p1-21.el7
- openssh-cavs RHEL 7 7.4p1-21.el7
red hat advisories RHSA-2019:0711RHSA-2019:2143
- openssh SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES for SAP 12 SP2 +8 more 7.2p2-74.30.1
- openssh-askpass-gnome SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES for SAP 12 SP2 +8 more 7.2p2-74.30.1
- openssh SLES for SAP 11 SP4, SLES 11 SP4 6.6p1-36.6.1
- openssh-askpass-gnome SLES for SAP 11 SP4, SLES 11 SP4 6.6p1-36.6.1
- openssh-openssl1 SLES 11-SECURITY 6.6p1-19.6.1
- openssh SLE Module for Server Applications 15, SLE Module for Basesystem 15 7.6p1-9.3.1
- openssh-askpass-gnome SLE Module for Desktop Applications 15 7.6p1-9.3.1
- openssh SLES 11 SP3-TERADATA, SLES 11 SP3-LTSS, SLE Point of Sale 11 SP3 6.2p2-0.41.5.1
suse advisories SUSE-SU-2018:3776-2SUSE-SU-2018:3910-1SUSE-SU-2018:3781-1SUSE-SU-2018:3776-1SUSE-SU-2018:3768-1SUSE-SU-2018:3686-1
- ssh-audit openSUSE Tumbleweed 2.5.0-1.2
- ssh-audit Package Hub 15 SP3, openSUSE Leap 15.3 2.5.0-bp153.2.3.1
- ssh-audit openSUSE Leap 15.2 2.5.0-lp152.2.3.1
opensuse advisories openSUSE-SU-2024:11407-1openSUSE-SU-2021:1390-1openSUSE-SU-2021:1383-1
- openssh Alpine 3.24, Alpine 3.23, Alpine 3.22 +13 more 7.7_p1-r4
- openssh Alpine 3.5 7.4_p1-r2
- openssh Alpine 3.6 7.5_p1-r3
- openssh Alpine 3.7 7.5_p1-r9
- openssh Alpine 3.8 7.7_p1-r3
alpine advisories ALPINE-CVE-2018-15473
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- openssh Arch Linux 7.8p1-1
arch linux advisories AVG-763
- github.com/openbsd/src@779974d commit
- securitytracker.com/id/1041487 advisory
- bugs.debian.org/906236 advisory
- openwall.com/lists/oss-security/2018/08/15/5 advisory
- oracle.com/security-alerts/cpujan2020.html advisory
- cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2018-15473 updated cvss 5.3
openssh: User enumeration via malformed packets in authentication requests
-
Red Hat Enterprise Linux 5 opensshaffected: workaround, no fix planned “Will not fix”
-
Red Hat Enterprise Linux Client (v. 7) openssh 7.4p1-21.el7, openssh-keycat 7.4p1-21.el7, openssh-server 7.4p1-21.el7, openssh-askpass 7.4p1-21.el7, openssh-clients 7.4p1-21.el7 Red Hat Enterprise Linux Client Optional (v. 7) openssh-cavs 7.4p1-21.el7, openssh-ldap 7.4p1-21.el7, pam_ssh_agent_auth 0.10.3-2.21.el7, openssh-server-sysvinit 7.4p1-21.el7 Red Hat Enterprise Linux ComputeNode (v. 7) openssh 7.4p1-21.el7, openssh-keycat 7.4p1-21.el7, openssh-server 7.4p1-21.el7, openssh-clients 7.4p1-21.el7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssh-cavs 7.4p1-21.el7, openssh-ldap 7.4p1-21.el7, openssh-askpass 7.4p1-21.el7, pam_ssh_agent_auth 0.10.3-2.21.el7, openssh-server-sysvinit 7.4p1-21.el7fixed: vendor fix RHSA-2019:2143
-
Red Hat Enterprise Linux Desktop (v. 6) openssh 5.3p1-124.el6_10, openssh-server 5.3p1-124.el6_10, openssh-askpass 5.3p1-124.el6_10, openssh-clients 5.3p1-124.el6_10 Red Hat Enterprise Linux Desktop Optional (v. 6) openssh-ldap 5.3p1-124.el6_10, pam_ssh_agent_auth 0.9.3-124.el6_10 Red Hat Enterprise Linux HPC Node (v. 6) openssh 5.3p1-124.el6_10, openssh-server 5.3p1-124.el6_10, openssh-clients 5.3p1-124.el6_10 Red Hat Enterprise Linux HPC Node Optional (v. 6) openssh-ldap 5.3p1-124.el6_10, openssh-askpass 5.3p1-124.el6_10, pam_ssh_agent_auth 0.9.3-124.el6_10 Red Hat Enterprise Linux Server (v. 6) openssh 5.3p1-124.el6_10, openssh-server 5.3p1-124.el6_10, openssh-askpass 5.3p1-124.el6_10, openssh-clients 5.3p1-124.el6_10fixed: vendor fix RHSA-2019:0711
-
Red Hat Enterprise Linux Server (v. 7) openssh 7.4p1-21.el7, openssh-keycat 7.4p1-21.el7, openssh-server 7.4p1-21.el7, openssh-askpass 7.4p1-21.el7, openssh-clients 7.4p1-21.el7fixed: vendor fix RHSA-2019:2143
-
Red Hat Enterprise Linux Server Optional (v. 6) openssh-ldap 5.3p1-124.el6_10, pam_ssh_agent_auth 0.9.3-124.el6_10fixed: vendor fix RHSA-2019:0711
-
Red Hat Enterprise Linux Server Optional (v. 7) openssh-cavs 7.4p1-21.el7, openssh-ldap 7.4p1-21.el7, pam_ssh_agent_auth 0.10.3-2.21.el7, openssh-server-sysvinit 7.4p1-21.el7fixed: vendor fix RHSA-2019:2143
-
Red Hat Enterprise Linux Workstation (v. 6) openssh 5.3p1-124.el6_10, openssh-server 5.3p1-124.el6_10, openssh-askpass 5.3p1-124.el6_10, openssh-clients 5.3p1-124.el6_10fixed: vendor fix RHSA-2019:0711
-
Red Hat Enterprise Linux Workstation (v. 7) openssh 7.4p1-21.el7, openssh-keycat 7.4p1-21.el7, openssh-server 7.4p1-21.el7, openssh-askpass 7.4p1-21.el7, openssh-clients 7.4p1-21.el7fixed: vendor fix RHSA-2019:2143
show 3 moreshow fewer
-
Red Hat Enterprise Linux Workstation Optional (v. 6) openssh-ldap 5.3p1-124.el6_10, pam_ssh_agent_auth 0.9.3-124.el6_10fixed: vendor fix RHSA-2019:0711
-
Red Hat Enterprise Linux Workstation Optional (v. 7) openssh-cavs 7.4p1-21.el7, openssh-ldap 7.4p1-21.el7, pam_ssh_agent_auth 0.10.3-2.21.el7, openssh-server-sysvinit 7.4p1-21.el7fixed: vendor fix RHSA-2019:2143
-
Red Hat Enterprise Linux 8 openssh, openssh-cavs, openssh-ldap, openssh-keycat, openssh-server, openssh-askpass, +2 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-22-349-21 updated cvss 5.3
Siemens SCALANCE X-200RNA Switch Devices
-
Siemens SCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2) <V3.2.7 Siemens SCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2) <V3.2.7 Siemens SCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3) <V3.2.7 Siemens SCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3) <V3.2.7 Siemens SCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3) <V3.2.7affected: fixed in V3.2.7, mitigation support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
Timeline
- First public exploit (EDB-45210)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10 mo ago
Exploit prediction
98.67% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/scanner/ssh/ssh_enumusers SSH Username Enumeration metasploit auxiliary, normal rank
- EDB-45939 OpenSSH < 7.7 - User Enumeration (2) remote, 2018-12-04
- EDB-45233 OpenSSH 2.3 < 7.7 - Username Enumeration remote, 2018-08-21
- EDB-45210 OpenSSH 2.3 < 7.7 - Username Enumeration (PoC) remote, 2018-08-16
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
References
-
github.com
/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0
patch
-
securitytracker.com
/id/1041487
vdb-entry, broken-link, patch, third-party-advisory
-
bugs.debian.org
/906236
issue-tracking, mailing-list, patch, third-party-advisory
-
openwall.com
/lists/oss-security/2018/08/15/5
mailing-list, patch, third-party-advisory
-
oracle.com
/security-alerts/cpujan2020.html
patch, third-party-advisory
-
cert-portal.siemens.com
/productcert/pdf/ssa-412672.pdf
patch, third-party-advisory
-
exploit-db.com
/exploits/45233/
exploit, third-party-advisory, vdb-entry
-
exploit-db.com
/exploits/45210/
exploit, third-party-advisory, vdb-entry
-
exploit-db.com
/exploits/45939/
exploit, third-party-advisory, vdb-entry
-
security.gentoo.org
/glsa/201810-03
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/3809-1/
vendor-advisory, third-party-advisory
-
debian.org
/security/2018/dsa-4280
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:0711
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:2143
vendor-advisory, third-party-advisory
-
security.netapp.com
/advisory/ntap-20181101-0001/
third-party-advisory
-
lists.debian.org
/debian-lts-announce/2018/08/msg00022.html
mailing-list, third-party-advisory
-
securityfocus.com
/bid/105140
vdb-entry, broken-link, third-party-advisory
-
psirt.global.sonicwall.com
/vuln-detail/SNWLID-2018-0011
third-party-advisory
Sources
- CVE List CVE-2018-15473
- NVD CVE-2018-15473
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.