Advisories » MGASA-2018-0363

Updated openssh packages fix security vulnerability

Publication date: 31 Aug 2018
Modification date: 31 Aug 2018
Type: security
Affected Mageia releases : 6
CVE: CVE-2018-15473

Description

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to
not delaying bailout for an invalid authenticating user until after the
packet containing the request has been fully parsed, related to
auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c (CVE-2018-15473).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=23452
• https://openwall.com/lists/oss-security/2018/08/15/5
• https://sekurak.pl/openssh-users-enumeration-cve-2018-15473/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15473

SRPMS

6/core

• openssh-7.5p1-2.2.mga6