Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could
be used by remote attackers to detect existence of users on a target system
when GSS2 is in use. NOTE: the discoverer states 'We understand that the
OpenSSH developers do not want to treat such a username enumeration (or
"oracle") as a vulnerability.'
sarnoldopenssh-ssh1 is provided for compatibility with old devices that
cannot be upgraded to modern protocols. Thus we may not provide security
support for this package if doing so would prevent access to equipment.
mdeslaurSUSE reverted the fix for this issue because of a regression

per the post to oss-security, upstream doesn't conside this to
be a security issue, and as of 2019-10-11, there is no upstream
fix for this
Ubuntu 12.04 ESM (Precise Pangolin):deferred (2019-10-11)
Ubuntu 14.04 ESM (Trusty Tahr):deferred (2019-10-11)
Ubuntu 16.04 LTS (Xenial Xerus):deferred (2019-10-11)
Ubuntu 18.04 LTS (Bionic Beaver):deferred (2019-10-11)
Ubuntu 19.10 (Eoan Ermine):deferred (2019-10-11)
Ubuntu 20.04 (Focal Fossa):deferred (2019-10-11)
Upstream:ignored (frozen on openssh 7.5p)
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Ubuntu 18.04 LTS (Bionic Beaver):needs-triage
Ubuntu 19.10 (Eoan Ermine):needs-triage
Ubuntu 20.04 (Focal Fossa):needs-triage
More Information

Updated: 2020-01-29 18:52:37 UTC (commit 40f18bf14da5fb50662e1f861ea594a462b207fe)