CVE-2018-15919

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-08-28 · updated 2026-06-17
Weakness: CWE-200

Description

Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability.'

Affected products

NetApp Cloud Backup: all versions
NetApp Cn1610 Firmware: all versions
NetApp Data Ontap Edge: all versions
NetApp Ontap Select Deploy: all versions
NetApp Steelstore: all versions
OpenSSH: from 5.9 through 7.8

References

http://seclists.org/oss-sec/2018/q3/180
http://www.securityfocus.com/bid/105163
https://security.netapp.com/advisory/ntap-20181221-0001/
http://seclists.org/oss-sec/2018/q3/180
http://www.securityfocus.com/bid/105163
https://security.netapp.com/advisory/ntap-20181221-0001/

Get alerted when CVE-2018-15919 or the next vulnerability affects your stack