CVE-2018-15473

Name of the Vulnerable Software and Affected Versions OpenSSH versions 7.7 and earlier

Description The issue is related to a user enumeration vulnerability. It is caused by the server's different responses to authentication requests when valid and invalid user accounts are present. An attacker can exploit this by sending specially crafted authentication requests to identify existing user accounts. The vulnerability is related to files auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

Recommendations For OpenSSH versions 7.7 and earlier, consider updating to a version later than 7.7 to resolve the issue. As a temporary workaround, consider restricting access to the authentication mechanism to minimize the risk of exploitation. Avoid using the authentication features in a way that could reveal user account information until the issue is resolved.