CVE-2018-15473

Description

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

Weakness classification

• CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Primary references

• cve@mitre.org — Mailing List, Patch, Third Party Advisory
• cve@mitre.org — Broken Link, Third Party Advisory, VDB Entry
• cve@mitre.org — Broken Link, Patch, Third Party Advisory, VDB Entry
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Issue Tracking, Mailing List, Patch, Third Party Advisory
• cve@mitre.org — Patch, Third Party Advisory
• cve@mitre.org — Patch
• cve@mitre.org — Mailing List, Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory