{"answers":{"affected":"It affects 22 products.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-15473 exists.","fix":"Apply the vendor's patch.","what":"CVE-2018-15473 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 17 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2018-15473 and fix it if it is affected.\n\nWhat it is: CVE-2018-15473 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 17 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-15473 exists.\n\nAffected product: Canonical Ubuntu Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2018-15473/ (Markdown: https://insights.sbomify.com/CVE-2018-15473/index.md)","id":"CVE-2018-15473","markdown":"https://insights.sbomify.com/CVE-2018-15473/index.md","name":"CVE-2018-15473","record":{"aliases":["ALPINE-CVE-2018-15473","DEBIAN-CVE-2018-15473","DLA-1474-1","DSA-4280-1","GHSA-c8qw-h3f6-fv63","MGASA-2018-0363","RHSA-2019:0711","RHSA-2019:2143","SUSE-SU-2018:3686-1","SUSE-SU-2018:3768-1","SUSE-SU-2018:3776-1","SUSE-SU-2018:3776-2","SUSE-SU-2018:3781-1","SUSE-SU-2018:3910-1","UBUNTU-CVE-2018-15473","openSUSE-SU-2021:1383-1","openSUSE-SU-2021:1390-1","openSUSE-SU-2024:11407-1"],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"OpenSSH server","requires_auth":"none","summary":"OpenSSH allows attackers to enumerate valid usernames due to a race condition in authentication packet parsing.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"mitre","cpe":[{"product":"ubuntu_linux","vendor":"canonical"},{"product":"debian_linux","vendor":"debian"},{"product":"aff_baseboard_management_controller","vendor":"netapp"},{"product":"cloud_backup","vendor":"netapp"},{"product":"clustered_data_ontap","vendor":"netapp"},{"product":"cn1610_firmware","vendor":"netapp"},{"product":"data_ontap","vendor":"netapp"},{"product":"data_ontap_edge","vendor":"netapp"},{"product":"fas_baseboard_management_controller","vendor":"netapp"},{"product":"oncommand_unified_manager","vendor":"netapp"},{"product":"ontap_select_deploy","vendor":"netapp"},{"product":"service_processor","vendor":"netapp"},{"product":"steelstore_cloud_integrated_storage","vendor":"netapp"},{"product":"storage_replication_adapter","vendor":"netapp"},{"product":"vasa_provider","vendor":"netapp"},{"product":"virtual_storage_console","vendor":"netapp"},{"product":"openssh","vendor":"openbsd"},{"product":"sun_zfs_storage_appliance_kit","vendor":"oracle"},{"product":"enterprise_linux_desktop","vendor":"redhat"},{"product":"enterprise_linux_server","vendor":"redhat"},{"product":"enterprise_linux_workstation","vendor":"redhat"},{"product":"scalance_x204rna_firmware","vendor":"siemens"}],"cvss":{"score":5.9,"severity":"medium","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-362","name":"Concurrent Execution using Shared Resource with Improper Synchronization"}],"description":"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.","ecosystems":["Red Hat:enterprise_linux:6::client","Red Hat:enterprise_linux:6::computenode","Red Hat:enterprise_linux:6::server","Red Hat:enterprise_linux:6::workstation","Red Hat:enterprise_linux:7::client","Red Hat:enterprise_linux:7::computenode","Red Hat:enterprise_linux:7::server","Red Hat:enterprise_linux:7::workstation","SUSE:Enterprise Storage 4","SUSE:Linux Enterprise Desktop 12 SP3","SUSE:Linux Enterprise Desktop 12 SP4","SUSE:Linux Enterprise Module for Basesystem 15","SUSE:Linux Enterprise Module for Desktop Applications 15","SUSE:Linux Enterprise Module for Server Applications 15","SUSE:Linux Enterprise Server 11 SP4","SUSE:Linux Enterprise Server 11-SECURITY","SUSE:Linux Enterprise Server 12 SP1-LTSS","SUSE:Linux Enterprise Server 12 SP2-BCL","SUSE:Linux Enterprise Server 12 SP2-LTSS","SUSE:Linux Enterprise Server 12 SP3","SUSE:Linux Enterprise Server 12 SP4","SUSE:Linux Enterprise Server 12-LTSS","SUSE:Linux Enterprise Server for SAP Applications 11 SP4","SUSE:Linux Enterprise Server for SAP Applications 12 SP1","SUSE:Linux Enterprise Server for SAP Applications 12 SP2","SUSE:Linux Enterprise Server for SAP Applications 12 SP3","SUSE:Linux Enterprise Server for SAP Applications 12 SP4","SUSE:OpenStack Cloud 7","SUSE:Package Hub 15 SP3","openSUSE:Leap 15.2","openSUSE:Leap 15.3","openSUSE:Tumbleweed"],"exploits":{"exploitdb":3,"first_seen":"2018-08-16","github_poc":41,"max_poc_stars":534,"metasploit":1,"nuclei":0,"refs":[{"date":"2018-08-21T00:09:56Z","kind":"github_poc","ref":"https://github.com/Rhynorater/CVE-2018-15473-Exploit","stars":534,"title":"Exploit written in Python for CVE-2018-15473 with threading and export formats"},{"date":"2018-08-17T23:48:15Z","kind":"github_poc","ref":"https://github.com/trimstray/massh-enum","stars":159,"title":"OpenSSH 2.3 up to 7.4 Mass Username Enumeration (CVE-2018-15473)."},{"date":"2018-10-03T10:18:04Z","kind":"github_poc","ref":"https://github.com/epi052/cve-2018-15473","stars":117,"title":"Multi-threaded, IPv6 aware, wordlists/single-user username enumeration via CVE-2018-15473"},{"date":"2020-11-29T17:36:11Z","kind":"github_poc","ref":"https://github.com/Sait-Nuri/CVE-2018-15473","stars":42,"title":"OpenSSH 2.3 \u003c 7.7 - Username Enumeration"},{"date":"2018-10-24T21:48:07Z","kind":"github_poc","ref":"https://github.com/r3dxpl0it/CVE-2018-15473","stars":17,"title":"OpenSSH 7.7 - Username Enumeration"},{"date":"2023-03-09T15:23:53Z","kind":"github_poc","ref":"https://github.com/sergiovks/SSH-User-Enum-Python3-CVE-2018-15473","stars":4,"title":"SSH User Enumerator in Python3, CVE-2018-15473, I updated the code of this exploit (https://www.exploit-db.com/exploits/45939) to work with python3 instead of python2."},{"date":"2018-08-19T11:23:54Z","kind":"github_poc","ref":"https://github.com/gbonacini/opensshenum","stars":3,"title":"CVE-2018-15473 - Opensshenum is an user enumerator exploiting an OpenSsh bug"},{"date":"2021-09-14T23:20:52Z","kind":"github_poc","ref":"https://github.com/MrDottt/CVE-2018-15473","stars":3,"title":"CVE-2018-15473 Exploit"}],"tier":"weaponised"},"has_fix":true,"headline":"Information disclosure in n/a","id":"CVE-2018-15473","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"canonical:ubuntu_linux","products":["canonical:ubuntu_linux","debian:debian_linux","netapp:cloud_backup","netapp:clustered_data_ontap","netapp:oncommand_unified_manager","netapp:steelstore_cloud_integrated_storage","netapp:virtual_storage_console","openbsd:openssh","redhat:enterprise_linux_desktop","redhat:enterprise_linux_server","redhat:enterprise_linux_workstation"],"type":"information_disclosure","year":"2018"},"n_packages":108,"n_references":18,"next":{"headline":"Code injection in n/a","id":"CVE-2018-15474"},"packages":[{"ecosystem":"Red Hat:enterprise_linux:6::client","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh","purl":"pkg:rpm/redhat/openssh","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::client","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-askpass","purl":"pkg:rpm/redhat/openssh-askpass","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::client","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-clients","purl":"pkg:rpm/redhat/openssh-clients","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::client","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-debuginfo","purl":"pkg:rpm/redhat/openssh-debuginfo","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::client","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-ldap","purl":"pkg:rpm/redhat/openssh-ldap","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::client","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-server","purl":"pkg:rpm/redhat/openssh-server","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::client","fixed":["0:0.9.3-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"pam_ssh_agent_auth","purl":"pkg:rpm/redhat/pam_ssh_agent_auth","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh","purl":"pkg:rpm/redhat/openssh","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-askpass","purl":"pkg:rpm/redhat/openssh-askpass","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-clients","purl":"pkg:rpm/redhat/openssh-clients","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-debuginfo","purl":"pkg:rpm/redhat/openssh-debuginfo","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-ldap","purl":"pkg:rpm/redhat/openssh-ldap","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-server","purl":"pkg:rpm/redhat/openssh-server","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","fixed":["0:0.9.3-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"pam_ssh_agent_auth","purl":"pkg:rpm/redhat/pam_ssh_agent_auth","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::server","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh","purl":"pkg:rpm/redhat/openssh","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::server","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-askpass","purl":"pkg:rpm/redhat/openssh-askpass","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::server","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-clients","purl":"pkg:rpm/redhat/openssh-clients","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::server","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-debuginfo","purl":"pkg:rpm/redhat/openssh-debuginfo","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::server","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-ldap","purl":"pkg:rpm/redhat/openssh-ldap","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::server","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-server","purl":"pkg:rpm/redhat/openssh-server","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::server","fixed":["0:0.9.3-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"pam_ssh_agent_auth","purl":"pkg:rpm/redhat/pam_ssh_agent_auth","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh","purl":"pkg:rpm/redhat/openssh","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-askpass","purl":"pkg:rpm/redhat/openssh-askpass","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-clients","purl":"pkg:rpm/redhat/openssh-clients","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-debuginfo","purl":"pkg:rpm/redhat/openssh-debuginfo","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-ldap","purl":"pkg:rpm/redhat/openssh-ldap","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","fixed":["0:5.3p1-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"openssh-server","purl":"pkg:rpm/redhat/openssh-server","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","fixed":["0:0.9.3-124.el6_10"],"introduced":["0"],"last_affected":[],"package":"pam_ssh_agent_auth","purl":"pkg:rpm/redhat/pam_ssh_agent_auth","source":"RHSA-2019:0711"},{"ecosystem":"Red Hat:enterprise_linux:7::client","fixed":["0:7.4p1-21.el7"],"introduced":["0"],"last_affected":[],"package":"openssh","purl":"pkg:rpm/redhat/openssh","source":"RHSA-2019:2143"},{"ecosystem":"Red Hat:enterprise_linux:7::client","fixed":["0:7.4p1-21.el7"],"introduced":["0"],"last_affected":[],"package":"openssh-askpass","purl":"pkg:rpm/redhat/openssh-askpass","source":"RHSA-2019:2143"},{"ecosystem":"Red Hat:enterprise_linux:7::client","fixed":["0:7.4p1-21.el7"],"introduced":["0"],"last_affected":[],"package":"openssh-cavs","purl":"pkg:rpm/redhat/openssh-cavs","source":"RHSA-2019:2143"},{"ecosystem":"Red Hat:enterprise_linux:7::client","fixed":["0:7.4p1-21.el7"],"introduced":["0"],"last_affected":[],"package":"openssh-clients","purl":"pkg:rpm/redhat/openssh-clients","source":"RHSA-2019:2143"},{"ecosystem":"Red Hat:enterprise_linux:7::client","fixed":["0:7.4p1-21.el7"],"introduced":["0"],"last_affected":[],"package":"openssh-debuginfo","purl":"pkg:rpm/redhat/openssh-debuginfo","source":"RHSA-2019:2143"},{"ecosystem":"Red Hat:enterprise_linux:7::client","fixed":["0:7.4p1-21.el7"],"introduced":["0"],"last_affected":[],"package":"openssh-keycat","purl":"pkg:rpm/redhat/openssh-keycat","source":"RHSA-2019:2143"},{"ecosystem":"Red Hat:enterprise_linux:7::client","fixed":["0:7.4p1-21.el7"],"introduced":["0"],"last_affected":[],"package":"openssh-ldap","purl":"pkg:rpm/redhat/openssh-ldap","source":"RHSA-2019:2143"},{"ecosystem":"Red Hat:enterprise_linux:7::client","fixed":["0:7.4p1-21.el7"],"introduced":["0"],"last_affected":[],"package":"openssh-server","purl":"pkg:rpm/redhat/openssh-server","source":"RHSA-2019:2143"},{"ecosystem":"Red Hat:enterprise_linux:7::client","fixed":["0:7.4p1-21.el7"],"introduced":["0"],"last_affected":[],"package":"openssh-server-sysvinit","purl":"pkg:rpm/redhat/openssh-server-sysvinit","source":"RHSA-2019:2143"},{"ecosystem":"Red Hat:enterprise_linux:7::client","fixed":["0:0.10.3-2.21.el7"],"introduced":["0"],"last_affected":[],"package":"pam_ssh_agent_auth","purl":"pkg:rpm/redhat/pam_ssh_agent_auth","source":"RHSA-2019:2143"},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","fixed":["0:7.4p1-21.el7"],"introduced":["0"],"last_affected":[],"package":"openssh","purl":"pkg:rpm/redhat/openssh","source":"RHSA-2019:2143"},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","fixed":["0:7.4p1-21.el7"],"introduced":["0"],"last_affected":[],"package":"openssh-askpass","purl":"pkg:rpm/redhat/openssh-askpass","source":"RHSA-2019:2143"}],"prev":{"headline":"Denial of service in n/a","id":"CVE-2018-15472"},"products":["n/a"],"published":"2018-08-17","related":[{"cvss_score":9.8,"headline":"SaltStack Salt Authentication Bypass","id":"CVE-2020-11651","kev_date_added":"2021-11-03","published":"2020-04-30"},{"cvss_score":9.8,"headline":"OpenSMTPD Remote Code Execution","id":"CVE-2020-7247","kev_date_added":"2022-03-25","published":"2020-01-29"},{"cvss_score":9.8,"headline":"Exim Out-of-bounds Write","id":"CVE-2019-16928","kev_date_added":"2022-03-03","published":"2019-09-27"},{"cvss_score":9.8,"headline":"Exim Buffer Overflow","id":"CVE-2018-6789","kev_date_added":"2021-11-03","published":"2018-02-08"},{"cvss_score":9.8,"headline":"Oracle Java SE and Java SE Embedded Remote Code Execution","id":"CVE-2015-2590","kev_date_added":"2022-03-03","published":"2015-07-16"},{"cvss_score":9.8,"headline":"Oracle JRE Remote Code Execution","id":"CVE-2013-0422","kev_date_added":"2022-05-25","published":"2013-01-10"},{"cvss_score":9.8,"headline":"Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution","id":"CVE-2011-3544","kev_date_added":"2022-03-03","published":"2011-10-19"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-12-17","vendors":["n/a"]},"summary":"OpenSSH allows attackers to enumerate valid usernames due to a race condition in authentication packet parsing.","url":"https://insights.sbomify.com/CVE-2018-15473/"}