CVE-2003-0190: OpenBSD OpenSSH

Medium severity, CVSS 5.0. EPSS: 76.8% chance of exploitation in the next 30 days.

OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.

Affected products

• OpenBSD OpenSSH: before 3.6.1 (fixed in 3.6.1); version 3.6.1 only
• Openpkg Openpkg: version 1.2 only; version 1.3 only
• Siemens Scalance x204rna Ecc Firmware: before 3.2.7 (fixed in 3.2.7)
• Siemens Scalance x204rna Firmware: before 3.2.7 (fixed in 3.2.7)

Published 2003-05-12. Last modified 2026-06-16.