CVE-2018-15473: Canonical Ubuntu Linux
Medium severity, CVSS 5.3. EPSS: 98.6% chance of exploitation in the next 30 days.
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
Affected products
- Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only
- Debian Debian Linux: version 8.0 only; version 9.0 only
- Netapp Aff Baseboard Management Controller: affected versions not specified
- Netapp Cloud Backup: affected versions not specified
- Netapp Clustered Data Ontap: affected versions not specified
- Netapp CN1610 Firmware: affected versions not specified
- Netapp Data Ontap: affected versions not specified
- Netapp Data Ontap Edge: affected versions not specified
- Netapp Fas Baseboard Management Controller: affected versions not specified
- Netapp Oncommand Unified Manager: from 9.4
- Netapp Ontap Select Deploy: affected versions not specified
- Netapp Service Processor: affected versions not specified
- Netapp Steelstore Cloud Integrated Storage: affected versions not specified
- Netapp Storage Replication Adapter: from 7.2
- Netapp Vasa Provider: from 7.2
- Netapp Virtual Storage Console: from 7.2
- OpenBSD OpenSSH: up to and including 7.7
- Oracle Sun ZFS Storage Appliance Kit: version 8.8.6 only
- Red Hat Enterprise Linux Desktop: version 6.0 only; version 7.0 only
- Red Hat Enterprise Linux Server: version 6.0 only; version 7.0 only
- Red Hat Enterprise Linux Workstation: version 6.0 only; version 7.0 only
- Siemens Scalance x204rna Firmware: before 3.2.7 (fixed in 3.2.7)
Published 2018-08-17. Last modified 2026-06-17.