high CVSS 8.5 EPSS 99% Public exploit available

CVE-2018-15473·OpenSSH vulnerability

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

Severity
high
Software
OpenSSH
Fixed in
1:7.7p1-4
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 99% — among the highest-scoring CVEs ever published. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 1:7.7p1-4

Fixed in: 1:7.7p1-4

How to fix this CVE

Update OpenSSH to version 1:7.7p1-4 or later to remediate the user enumeration vulnerability. This fix ensures that authentication failures are processed uniformly regardless of user validity, preventing attackers from discovering valid usernames through timing analysis. Restart the SSH service after patching to apply the security update.

sudo dnf update openssh openssh-server openssh-clients

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

Multiple SSH authentication attempts with invalid usernames resulting in connection drops before full packet processing; timing-based exploitation pattern showing consistent response deltas between valid and invalid users (~milliseconds difference) in rapid-fire authentication requests

How to check if you are affected

  1. Run `ssh -V` or `sshd -v` to check the installed OpenSSH version and confirm it is below 7.7p1-4
  2. Verify SSH service is running with `sudo systemctl status sshd` and check if authentication methods (GSS, hostbased, pubkey) are enabled in `/etc/ssh/sshd_config`
  3. Search SSH authentication logs with `sudo grep -i 'invalid user' /var/log/auth.log | head -20` to identify potential enumeration attempts or failed login patterns
  4. After updating, confirm the patch was applied by running `ssh -V` again and verifying the version matches 7.7p1-4 or higher, then restart SSH with `sudo systemctl restart sshd`

FAQ

What is CVE-2018-15473?

CVE-2018-15473 is a user enumeration vulnerability in OpenSSH where the server processes authentication requests too quickly for invalid users, allowing attackers to enumerate valid usernames by measuring response times across GSS, hostbased, and public key authentication methods.

Is CVE-2018-15473 being actively exploited?

While not currently listed in the CISA KEV catalog, public exploits have been released for this vulnerability, making it a practical risk for internet-facing SSH servers.

What versions of OpenSSH are affected by CVE-2018-15473?

OpenSSH versions up to and including 7.7p1-3 are vulnerable; version 7.7p1-4 and later contain the fix.

How do I check if my server is vulnerable to CVE-2018-15473?

Run `ssh -V` to display your OpenSSH version; if the output shows a version lower than 7.7p1-4, your server is vulnerable to this enumeration attack.

Does Defensia detect CVE-2018-15473?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If OpenSSH is installed on a monitored server, CVE-2018-15473 will appear in your dashboard with remediation steps.

Related OpenSSH CVEs

CVE-2016-6515CVSS 9The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
CVE-2008-0166CVSS 9OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
CVE-2016-10009CVSS 8.5Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
CVE-2016-6210CVSS 8.5sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
CVE-2024-6387CVSS 8.1A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2018-15473. Free for 1 server.

Get started free