Description
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | 1:7.7p1-4 | — |
| Debian 13 | openssh | 1:7.7p1-4 | — |
| Debian 12 | openssh | 1:7.7p1-4 | — |
| Debian 9 | openssh | 1:7.4p1-10+deb9u4 | DSA-4280-1 |
| Debian 8 | openssh | 1:6.7p1-5+deb8u5 | DLA-1474-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | openssh | 1:7.6p1-4ubuntu0.1 | USN-3809-1 |
| Ubuntu 16.04 LTS | openssh | 1:7.2p2-4ubuntu2.6 | USN-3809-1 |
| Ubuntu 14.04 LTS | openssh | 1:6.6p1-2ubuntu2.11 | USN-3809-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | openssh +7 | 7.4p1-21.el7 | RHSA-2019:2143 |
| RHEL 7 | pam_ssh_agent_auth | 0.10.3-2.21.el7 | RHSA-2019:2143 |
| RHEL 6 | openssh +4 | 5.3p1-124.el6_10 | RHSA-2019:0711 |
| RHEL 6 | pam_ssh_agent_auth | 0.9.3-124.el6_10 | RHSA-2019:0711 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | openssh +1 | 7.6p1-9.3.1 | SUSE-SU-2018:3686-1 |
| SLES 12 SP4 | openssh +1 | 7.2p2-74.30.1 | SUSE-SU-2018:3910-1 |
| SLES 12 SP3 | openssh +1 | 7.2p2-74.30.1 | SUSE-SU-2018:3910-1 |
| SLES 12 SP2 | openssh +1 | 7.2p2-74.30.1 | SUSE-SU-2018:3910-1 |
| SLES 12 SP1 | openssh +1 | 6.6p1-54.18.1 | SUSE-SU-2018:3776-1 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | openssh +1 | 6.6p1-54.18.1 | SUSE-SU-2018:3776-1 |
| SLES 11 SP4 | openssh +1 | 6.6p1-36.6.1 | SUSE-SU-2018:3781-1 |
| SLES 11 SP3 | openssh +1 | 6.2p2-0.41.5.1 | SUSE-SU-2018:3540-1 |
| SLES 11 | openssh-openssl1 | 6.6p1-19.6.1 | SUSE-SU-2018:3768-1 |
| SLES for SAP 12 SP4 | openssh +1 | 7.2p2-74.30.1 | SUSE-SU-2018:3910-1 |
| SLES for SAP 12 SP3 | openssh +1 | 7.2p2-74.30.1 | SUSE-SU-2018:3910-1 |
| SLES for SAP 12 SP2 | openssh +1 | 7.2p2-74.30.1 | SUSE-SU-2018:3910-1 |
| SLES for SAP 12 SP1 | openssh +1 | 6.6p1-54.18.1 | SUSE-SU-2018:3776-2 |
| SLES for SAP 11 SP4 | openssh +1 | 6.6p1-36.6.1 | SUSE-SU-2018:3781-1 |
| SUSE Package Hub 15 SP3 | ssh-audit | 2.5.0-bp153.2.3.1 | openSUSE-SU-2021:1390-1 |
| SUSE OpenStack Cloud 7 | openssh +1 | 7.2p2-74.30.1 | SUSE-SU-2018:3910-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | openssh +1 | 6.2p2-0.41.5.1 | SUSE-SU-2018:3540-1 |
| SUSE Enterprise Storage 4 | openssh +1 | 7.2p2-74.30.1 | SUSE-SU-2018:3910-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ssh-audit | 2.5.0-1.2 | openSUSE-SU-2024:11407-1 |
| openSUSE Leap 15.3 | ssh-audit | 2.5.0-bp153.2.3.1 | openSUSE-SU-2021:1390-1 |
| openSUSE Leap 15.2 | ssh-audit | 2.5.0-lp152.2.3.1 | openSUSE-SU-2021:1383-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openssh | 7.7_p1-r4 | — |
| Alpine v3.23 | openssh | 7.7_p1-r4 | — |
| Alpine v3.22 | openssh | 7.7_p1-r4 | — |
| Alpine v3.21 | openssh | 7.7_p1-r4 | — |
| Alpine v3.20 | openssh | 7.7_p1-r4 | — |
Show 15 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | openssh | 7.7_p1-r4 | — |
| Alpine v3.18 | openssh | 7.7_p1-r4 | — |
| Alpine v3.17 | openssh | 7.7_p1-r4 | — |
| Alpine v3.16 | openssh | 7.7_p1-r4 | — |
| Alpine v3.15 | openssh | 7.7_p1-r4 | — |
| Alpine v3.14 | openssh | 7.7_p1-r4 | — |
| Alpine v3.13 | openssh | 7.7_p1-r4 | — |
| Alpine v3.12 | openssh | 7.7_p1-r4 | — |
| Alpine v3.11 | openssh | 7.7_p1-r4 | — |
| Alpine v3.10 | openssh | 7.7_p1-r4 | — |
| Alpine v3.9 | openssh | 7.7_p1-r4 | — |
| Alpine v3.8 | openssh | 7.7_p1-r3 | — |
| Alpine v3.7 | openssh | 7.5_p1-r9 | — |
| Alpine v3.6 | openssh | 7.5_p1-r3 | — |
| Alpine v3.5 | openssh | 7.4_p1-r2 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | openssh +7 | 7.4p1-16.amzn2.0.5 | ALAS2-2018-1075 |
| Amazon Linux 2 | pam_ssh_agent_auth | 0.10.3-2.16.amzn2.0.5 | ALAS2-2018-1075 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | openssh +7 | 7.4p1-21.el7 | ELSA-2019-2143 |
| Oracle Linux 7 | pam_ssh_agent_auth | 0.10.3-2.21.el7 | ELSA-2019-2143 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
SSH Username Enumeration
auxiliary/scanner/ssh/ssh_enumusers
Exploit-DB 3
- OpenSSH < 7.7 - User Enumeration (2) EDB-45939 · remote · Dec 4, 2018
- OpenSSH 2.3 < 7.7 - Username Enumeration EDB-45233 · remote · Aug 21, 2018 · verified
- OpenSSH 2.3 < 7.7 - Username Enumeration (PoC) EDB-45210 · remote · Aug 16, 2018 · verified
GitHub 41 repositories · most starred shown
-
Rhynorater/CVE-2018-15473-Exploit ★ 535 · Aug 21, 2018
Exploit written in Python for CVE-2018-15473 with threading and export formats
-
trimstray/massh-enum ★ 160 · Aug 17, 2018
OpenSSH 2.3 up to 7.4 Mass Username Enumeration (CVE-2018-15473).
-
epi052/cve-2018-15473 ★ 117 · Oct 3, 2018
Multi-threaded, IPv6 aware, wordlists/single-user username enumeration via CVE-2018-15473
-
Sait-Nuri/CVE-2018-15473 ★ 42 · Nov 29, 2020
OpenSSH 2.3 < 7.7 - Username Enumeration
-
r3dxpl0it/CVE-2018-15473 ★ 17 · Oct 24, 2018
OpenSSH 7.7 - Username Enumeration
-
sergiovks/SSH-User-Enum-Python3-CVE-2018-15473 ★ 4 · Mar 9, 2023
SSH User Enumerator in Python3, CVE-2018-15473, I updated the code of this exploit (https://www.exploit-db.com/exploits/45939) to work with python3 instead of python2.
-
MrDottt/CVE-2018-15473 ★ 3 · Sep 14, 2021
CVE-2018-15473 Exploit
-
gbonacini/opensshenum ★ 3 · Aug 19, 2018
CVE-2018-15473 - Opensshenum is an user enumerator exploiting an OpenSsh bug
-
K3rn3l-32/Threaded-CVE-2018-15473 ★ 2 · Mar 25, 2026
A Python 3 reimplementation of the classic CVE-2018-15473 OpenSSH user enumeration exploit, extended with multi-threading, wordlist support, automatic vulnerability detection, and thread-safe exploit…
-
JoeBlackSecurity/SSHUsernameBruter-SSHUB ★ 2 · Oct 31, 2018
Fully functional script for brute forcing SSH and trying credentials - CVE-2018-15473
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 20
- RHSA-2019:2143 Red Hat Security Advisory: openssh security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2019:0711 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-3809-1 openssh vulnerabilities Ubuntu Security Notices (USN) · May 4, 2026
- DSA-4280-1 openssh - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1474-1 openssh - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2021:1390-1 Security update for ssh-audit SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3686-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3540-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3768-1 Security update for openssh-openssl1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3776-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:1383-1 Security update for ssh-audit SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3910-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11407-1 ssh-audit-2.5.0-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3781-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3776-2 Security update for openssh SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2024-1082 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 9, 2024
- ICSA-22-349-21 Siemens SCALANCE X-200RNA Switch Devices CISA ICS & IT advisories · Dec 13, 2022
- SSA-412672 SSA-412672: Multiple OpenSSL and OpenSSH Vulnerabilities in SCALANCE X-200RNA Switch Devices before V3.2.7 Siemens ProductCERT · Dec 13, 2022
- ELSA-2019-2143 Low: openssh security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 13, 2019
- ALAS2-2018-1075 Low: openssh security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 25, 2018
References
- GLSA-201810-03 vendor-advisory
- 1041487 vdb-entry
- 45233 exploit
- https://bugs.debian.org/906236
- 45210 exploit
- https://security.netapp.com/advisory/ntap-20181101-0001/
- https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0
- USN-3809-1 vendor-advisory
- [debian-lts-announce] 20180821 [SECURITY] [DLA-1474-1] openssh security update mailing-list
- 105140 vdb-entry
- DSA-4280 vendor-advisory
- 45939 exploit
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0011
- http://www.openwall.com/lists/oss-security/2018/08/15/5
- RHSA-2019:0711 vendor-advisory
- RHSA-2019:2143 vendor-advisory
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf