CVE-2007-2243: OpenBSD OpenSSH

Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days.

OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483.

Affected products

• OpenBSD OpenSSH: version 1.2 only; version 1.2.1 only; version 1.2.2 only; version 1.2.3 only; version 1.2.27 only; version 2.1 only; …

Published 2007-04-25. Last modified 2026-06-16.