VULNERABILITY INTELLIGENCE

CVE-2017-2659

CVSS score5.3 MEDIUM
EPSS probability1.50%
CISA KEVNot currently listed
Published2019-03-21
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI authentication failure was incorrectly counted towards the maximum allowed number of password attempts.

Weakness classification

  • CWE-209: Generation of Error Message Containing Sensitive Information
  • CWE-287: Improper Authentication

Primary references