CVE-2018-15599: Infoleak
The recvmsguserauthrequest function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSHMSGUSERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-15599?
CVE-2018-15599 is classified as a user enumeration vulnerability which can be exploited to determine valid usernames.
How do I fix CVE-2018-15599?
To mitigate CVE-2018-15599, upgrade to Dropbear SSH version 2018.77 or later.
Which software is affected by CVE-2018-15599?
CVE-2018-15599 affects Dropbear SSH versions up to and including 2018.76 and Debian Linux 8.0.
What is the impact of CVE-2018-15599?
The impact of CVE-2018-15599 allows attackers to infer the validity of usernames based on SSH_MSG_USERAUTH message handling.
Is CVE-2018-15599 related to other vulnerabilities?
CVE-2018-15599 has similarities to CVE-2018-15473, as both involve user enumeration in different contexts.