CVE-2018-15473
MediumPublic exploitOpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
Published Aug 17, 2018 · Updated Aug 4, 2026 · Also known as ALPINE-CVE-2018-15473, DEBIAN-CVE-2018-15473, DLA-1474-1, DSA-4280-1, SUSE-SU-2018:3686-1, SUSE-SU-2018:3768-1, SUSE-SU-2018:3776-1, SUSE-SU-2018:3776-2, SUSE-SU-2018:3781-1, SUSE-SU-2018:3910-1, UBUNTU-CVE-2018-15473
Key Facts
Patch immediately- CVE-2018-15473 is a medium-severity vulnerability (CVSS 5.9 v3.1) affecting Aff Baseboard Management Controller (Netapp), Cloud Backup (Netapp), Data Ontap Edge (Netapp) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 99% probability of exploitation in the next 30 days.
- Fixed versions are available, including Openssh <=7.7, Openssh 0:5.3p1-124.el6_10, Openssh 0:7.4p1-21.el7.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
99%
Higher than 99.9% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2018-15473 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
Affected Products
239 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Aff Baseboard Management ControllerNetapp | See advisory | n/a |
| Cloud BackupNetapp | See advisory | n/a |
| Data Ontap EdgeNetapp | See advisory | n/a |
| Fas Baseboard Management ControllerNetapp | See advisory | n/a |
| Oncommand Unified ManagerNetapp | See advisory | n/a |
Patched Releases
Openssh
<=7.7, 0:5.3p1-124.el6_10, 0:7.4p1-21.el7, 1:6.6p1-2ubuntu2.11, 1:6.7p1-5+deb8u5, 1:7.2p2-4ubuntu2.6, 1:7.4p1-10+deb9u4, 1:7.6p1-4ubuntu0.1, 1:7.7p1-4, 5.3p1-124.el6_10, 5.3p1-124.el6_10+sp999, 6.2p2-0.41.5.1, 6.6p1-36.6.1, 6.6p1-54.18.1, 7.2p2-25.1, 7.2p2-74.30.1, 7.4_p1-r2, 7.4p1-16.71.amzn1, 7.4p1-16.amzn2.0.5, 7.4p1-21.el7, 7.4p1-8.ph1, 7.5_p1-r3, 7.5_p1-r9, 7.5p1-11.ph2, 7.6p1-9.3.1, 7.6p1-lp150.8.3.1, 7.7_p1-r3, 7.7_p1-r4, 7.8p1-1
openssh-askpass
5.3p1-124.el6_10, 6.2p2-0.41.5.1, 7.4p1-16.amzn2.0.5, 7.4p1-21.el7
openssh-askpass-gnome
6.2p2-0.41.5.1, 6.6p1-36.6.1, 6.6p1-54.18.1, 7.2p2-25.1, 7.2p2-74.30.1, 7.6p1-9.3.1, 7.6p1-lp150.8.3.1
openssh-cavs
7.2p2-25.1, 7.4p1-16.71.amzn1, 7.4p1-16.amzn2.0.5, 7.4p1-21.el7, 7.6p1-lp150.8.3.1
openssh-clients
5.3p1-124.el6_10, 7.4p1-16.71.amzn1, 7.4p1-16.amzn2.0.5, 7.4p1-21.el7
openssh-fips
6.6p1-36.6.1, 6.6p1-54.18.1, 7.2p2-25.1, 7.2p2-74.30.1, 7.6p1-9.3.1, 7.6p1-lp150.8.3.1
openssh-helpers
6.6p1-36.6.1, 6.6p1-54.18.1, 7.2p2-25.1, 7.2p2-74.30.1, 7.6p1-9.3.1, 7.6p1-lp150.8.3.1
openssh-keycat
7.4p1-16.71.amzn1, 7.4p1-16.amzn2.0.5, 7.4p1-21.el7
openssh-ldap
5.3p1-124.el6_10, 7.4p1-16.71.amzn1, 7.4p1-16.amzn2.0.5, 7.4p1-21.el7
openssh-openssl1
6.6p1-19.6.1
openssh-openssl1-helpers
6.6p1-19.6.1
openssh-server
5.3p1-124.el6_10, 7.4p1-16.71.amzn1, 7.4p1-16.amzn2.0.5, 7.4p1-21.el7
openssh-server-sysvinit
7.4p1-16.amzn2.0.5, 7.4p1-21.el7
pam_ssh_agent_auth
0.10.3-2.16.71.amzn1, 0.10.3-2.16.amzn2.0.5, 0.10.3-2.21.el7, 0.9.3-124.el6_10
rootio-openssh
1:7.7p1-4, 7.7_p1-r4
seal-openssh
5.3p1-124.el6_10+sp999
Scalance X204rna Firmware
3.2.7
ssh-audit
2.5.0-1.2, 2.5.0-bp153.2.3.1, 2.5.0-lp152.2.3.1
Timeline
Publicly disclosed
Aug 17, 2018
Last updated
Aug 4, 2026
Weakness Type
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
References
- advisoryRHSA-2019:0711
- advisoryRHSA-2019:2143
- advisoryhttps://bugzilla.suse.com/1016370
- advisoryhttps://bugzilla.suse.com/1065000
- advisoryhttps://bugzilla.suse.com/1076957
FAQ
Common Questions.
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
Affected: Aff Baseboard Management Controller (Netapp); Cloud Backup (Netapp); Data Ontap Edge (Netapp), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Openssh <=7.7, Openssh 0:5.3p1-124.el6_10, Openssh 0:7.4p1-21.el7.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2018-15473 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo