CVE-2017-2659: High severity dropbear ssh vulnerability
It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI authentication failure was incorrectly counted towards the maximum allowed number of password attempts.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2659?
CVE-2017-2659 has a medium severity level due to its potential impact on unauthorized access attempts.
How do I fix CVE-2017-2659?
To fix CVE-2017-2659, update Dropbear SSH to version 2013.59 or later.
What is the main issue described in CVE-2017-2659?
The main issue in CVE-2017-2659 is the leaking of username validity during GSSAPI authentication, which can incorrectly affect account lockout policies.
Which versions of Dropbear SSH are affected by CVE-2017-2659?
Dropbear SSH versions prior to 2013.59 are affected by CVE-2017-2659.
Is CVE-2017-2659 a critical vulnerability?
No, CVE-2017-2659 is not classified as a critical vulnerability, but it poses risks that should be addressed promptly.