Bug 1619063 (CVE-2018-15473)
| Summary: | CVE-2018-15473 openssh: User enumeration via malformed packets in authentication requests | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Sam Fowler <sfowler> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | abhgupta, apmukher, atul.redhat, bpowers, christophe.palies, cwarfiel, dbaker, dberry, dmoppert, dwalsh, fkrska, gscott, guliu, jared.trouth.mpru, jfch, jjelen, jokerman, joshua.megerman, lcaparel, lkundrak, mabrown, mattias.ellert, mhernon, mr.xkurt, mthacker, nmavrogi, plautrba, ponikam, psampaio, sebastian.benner, security-response-team, sfowler, slawomir, snavale, sparks, sthangav, tcrider, tmraz, trankin, yiwu, yozone |
| Target Milestone: | --- | Keywords: | Reopened, Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A user enumeration vulnerability flaw was found in OpenSSH, though version 7.7. The vulnerability occurs by not delaying bailout for an invalid authenticated user until after the packet containing the request has been fully parsed. The highest threat from this vulnerability is to data confidentiality.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-10 10:36:07 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1619064, 1619065, 1619079, 1666731, 1690045, 1850669 | ||
| Bug Blocks: | 1619067 | ||
|
Description
Sam Fowler
2018-08-20 01:20:12 UTC
Created openssh tracking bugs for this issue: Affects: fedora-all [bug 1619064] Statement: Red Hat Product Security has rated this issue as having Low severity. An attacker could use this flaw to determine whether given usernames exist or not on the server, but no further information is disclosed and there is no availability or integrity impact. A future update may address this issue. Mitigation: Configuring your firewall to limit the origin and/or rate of incoming ssh connections (using the netfilter xt_recent module) will limit the impact of this attack, as it requires a new TCP connection for each username tested. This configuration also provides some protection against brute-force attacks on SSH passwords or keys. See the following article for more information on limiting access to SSHD: https://access.redhat.com/solutions/8687 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2019:0711 https://access.redhat.com/errata/RHSA-2019:0711 I see that a fix was released for RHEL 6 last month, is a fix planned to be released for RHEL 7? It seems odd to only fix the older OS release and not the current one.. Yes @joshua.megerman its correct.. this vulnerability is still in RHEL 7. Red Hat has to release the update for latest OS as well Customer is having this bug for RHEL 7. Will there be errata released for RHEL 7? as I can see the bug status is closed but we are still looking for RHEL 7 errata. Please confirm. This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2143 https://access.redhat.com/errata/RHSA-2019:2143 |