PT-2018-2784 · Openssh+3 · Openssh+3

Published 2018-08-28 · Updated 2025-11-04 · CVE-2018-15919

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSSH versions through 7.8

Description The issue is related to the auth-gss2.c file in OpenSSH, which lacks protection of service data. This could allow a remote attacker to disclose protected information. Additionally, remotely observable behavior in auth-gss2.c could be used by remote attackers to detect the existence of users on a target system when GSS2 is in use.

Recommendations For OpenSSH versions through 7.8, consider disabling the GSS2 authentication mechanism as a temporary workaround until a patch is available. Restrict access to the auth-gss2.c module to minimize the risk of exploitation. Avoid using the GSS2 authentication mechanism in the affected OpenSSH versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2018-2598

ALT-PU-2024-3921

ALT-PU-2024-4077

ALT-PU-2024-4467

ALT-PU-2024-9513

BDU:2019-01833

CVE-2018-15919

ECHO-765E-25A4-4A31

OPENSUSE-SU-2018_3801-1

Affected Products

Alt Linux

Debian

Openssh

Suse

References · 16

• https://cve.org/CVERecord?id=CVE-2018-15919 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-15919 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-15919 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15919 · Security Note
• https://bdu.fstec.ru/vul/2019-01833 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-15919 · Vendor Advisory
• http://seclists.org/oss-sec/2018/q3/180 · Patch
• https://osv.dev/vulnerability/CVE-2018-15919 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-15919 · Vendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10269&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_GB · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10269&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_GB · Note
• https://security.netapp.com/advisory/ntap-20181221-0001 · Note
• http://openwall.com/lists/oss-security/2018/08/27/2 · Note
• http://securityfocus.com/bid/105163 · Note
• https://reddit.com/r/vmware/comments/1ooh3c5/thanks_for_not_patching_skyline_health · Reddit Post