CVE-2018-15919

Priority
Description
Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could
be used by remote attackers to detect existence of users on a target system
when GSS2 is in use. NOTE: the discoverer states 'We understand that the
OpenSSH developers do not want to treat such a username enumeration (or
"oracle") as a vulnerability.'
Notes
sarnoldopenssh-ssh1 is provided for compatibility with old devices that
cannot be upgraded to modern protocols. Thus we may not provide security
support for this package if doing so would prevent access to equipment.
mdeslaurSUSE reverted the fix for this issue because of a regression

per the post to oss-security, upstream doesn't conside this to
be a security issue, and as of 2019-10-11, there is no upstream
fix for this
Package
Upstream:needs-triage
Ubuntu 12.04 ESM (Precise Pangolin):deferred (2019-10-11)
Ubuntu 14.04 ESM (Trusty Tahr):deferred (2019-10-11)
Ubuntu 16.04 LTS (Xenial Xerus):deferred (2019-10-11)
Ubuntu 18.04 LTS (Bionic Beaver):deferred (2019-10-11)
Ubuntu 19.04 (Disco Dingo):ignored (reached end-of-life)
Ubuntu 19.10 (Eoan Ermine):deferred (2019-10-11)
Ubuntu 20.04 (Focal Fossa):deferred (2019-10-11)
Package
Upstream:ignored (frozen on openssh 7.5p)
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Ubuntu 18.04 LTS (Bionic Beaver):needs-triage
Ubuntu 19.04 (Disco Dingo):ignored (reached end-of-life)
Ubuntu 19.10 (Eoan Ermine):needs-triage
Ubuntu 20.04 (Focal Fossa):needs-triage
More Information

Updated: 2020-01-23 20:38:15 UTC (commit b4629892d998f2ede31f59bb7508dc50a92ac664)