Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability.'

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openssh: scp allows command injection when using backtick characters in the destination argument     (CVE-2020-15778)

  - Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to     detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We     understand that the OpenSSH developers do not want to treat such a username enumeration (or oracle) as a     vulnerability.' (CVE-2018-15919)

  - In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions     via the filename of . or an empty filename. The impact is modifying the permissions of the target     directory on the client side. (CVE-2018-20685)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openssh: User enumeration via malformed packets in authentication requests (CVE-2018-15919)

  - openssh: authentication bypass via row hammer attack (CVE-2023-51767)

  - OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username     and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a     challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not     recognize user enumeration as a vulnerability for this product (CVE-2016-20012)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the version of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - Remotely observable behaviour in auth-gss2.c in OpenSSH     through 7.8 could be used by remote attackers to detect     existence of users on a target system when GSS2 is in     use. NOTE: the discoverer states 'We understand that     the OpenSSH developers do not want to treat such a     username enumeration (or 'oracle') as a     vulnerability.'(CVE-2018-15919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Remotely observable behaviour in auth-gss2.c in OpenSSH     through 7.8 could be used by remote attackers to detect     existence of users on a target system when GSS2 is in     use. NOTE: the discoverer states 'We understand that     the OpenSSH developers do not want to treat such a     username enumeration (or 'oracle') as a     vulnerability.'(CVE-2018-15919)

  - An issue was discovered in OpenSSH 7.9. Due to missing     character encoding in the progress display, a malicious     server (or Man-in-The-Middle attacker) can employ     crafted object names to manipulate the client output,     e.g., by using ANSI control codes to hide additional     files being transferred. This affects     refresh_progress_meter() in     progressmeter.c.(CVE-2019-6109)

  - An issue was discovered in OpenSSH 7.9. Due to the scp     implementation being derived from 1983 rcp, the server     chooses which files/directories are sent to the client.
    However, the scp client only performs cursory     validation of the object name returned (only directory     traversal attacks are prevented). A malicious scp     server (or Man-in-The-Middle attacker) can overwrite     arbitrary files in the scp client target directory. If     recursive operation (-r) is performed, the server can     manipulate subdirectories as well (for example, to     overwrite the .ssh/authorized_keys     file).(CVE-2019-6111)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the openssh packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - Remotely observable behaviour in auth-gss2.c in OpenSSH     through 7.8 could be used by remote attackers to detect     existence of users on a target system when GSS2 is in     use. NOTE: the discoverer states 'We understand that     the OpenSSH developers do not want to treat such a     username enumeration (or 'oracle') as a     vulnerability.'(CVE-2018-15919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Remotely observable behaviour in auth-gss2.c in OpenSSH     through 7.8 could be used by remote attackers to detect     existence of users on a target system when GSS2 is in     use. NOTE: the discoverer states 'We understand that     the OpenSSH developers do not want to treat such a     username enumeration (or 'oracle') as a     vulnerability.'(CVE-2018-15919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of OpenSSH is prior to 7.9 and is affected by a access validation error vulnerability in OpenSSH through 7.8 that could be used by remote attackers to detect existence of users on a target system when GSS2 is in use.

This update for openssh fixes the following issues :

  - CVE-2018-15919: Remotely observable behaviour in     auth-gss2.c in OpenSSH could be used by remote attackers     to detect existence of users on a target system when     GSS2 is in use. OpenSSH developers do not want to treat     such a username enumeration (or 'oracle') as a     vulnerability. (bsc#1106163)

  - CVE-2018-15473: OpenSSH was prone to a user existance     oracle vulnerability due to not delaying bailout for an     invalid authenticating user until after the packet     containing the request has been fully parsed, related to     auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
    (bsc#1105010)

The following non-security issues were fixed :

  - Stop leaking File descriptors (bsc#964336)

  - sftp-client.c returns wrong error code upon failure     (bsc#1091396)

  - added pam_keyinit to pam configuration file     (bsc#1081947)

This update was imported from the SUSE:SLE-15:Update update project.

This update for openssh fixes the following issues :

CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such a username enumeration (or 'oracle') as a vulnerability.
(bsc#1106163)

CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (bsc#1105010)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues :

Following security issues have been fixed :

CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such a username enumeration (or 'oracle') as a vulnerability.
(bsc#1106163)

CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (bsc#1105010)

Also the following security related hardening change was done: Removed arcfour,blowfish,cast from list of default ciphers as they are long discontinued and should no longer be used. (bsc#982273)

And 

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues :

Following security issues have been fixed :

CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such a username enumeration (or 'oracle') as a vulnerability.
(bsc#1106163)

CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (bsc#1105010)

Also the following security related hardening change was done: Remove arcfour,cast,blowfish from list of default ciphers. (bsc#982273)

And 

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues :

Security issues fixed :

CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such a username enumeration (or 'oracle') as a vulnerability.
(bsc#1106163)

CVE-2017-15906: The process_open function in sftp-server.c in OpenSSH did not properly prevent write operations in readonly mode, which allowed attackers to create zero-length files. (bsc#1065000, bsc#1106726)

CVE-2016-10708: sshd allowed remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c. (bsc#1076957)

CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (bsc#1105010)

CVE-2016-10012: Removed pre-auth compression support from the server to prevent possible cryptographic attacks. (bsc#1016370)

Bugs fixed: Fixed failing 'AuthorizedKeysCommand' within a 'Match User' block in sshd_config (bsc#1105180)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198974	RHEL 7 : openssh (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198948	RHEL 8 : openssh (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
141700	EulerOS Virtualization 3.0.2.2 : openssh (EulerOS-SA-2020-2204)	Nessus	Huawei Local Security Checks	medium
137938	EulerOS Virtualization 3.0.6.0 : openssh (EulerOS-SA-2020-1719)	Nessus	Huawei Local Security Checks	medium
137499	EulerOS 2.0 SP2 : openssh (EulerOS-SA-2020-1657)	Nessus	Huawei Local Security Checks	medium
136224	EulerOS Virtualization for ARM 64 3.0.2.0 : openssh (EulerOS-SA-2020-1521)	Nessus	Huawei Local Security Checks	medium
135548	EulerOS 2.0 SP3 : openssh (EulerOS-SA-2020-1419)	Nessus	Huawei Local Security Checks	medium
135147	EulerOS Virtualization for ARM 64 3.0.6.0 : openssh (EulerOS-SA-2020-1360)	Nessus	Huawei Local Security Checks	medium
134807	EulerOS 2.0 SP5 : openssh (EulerOS-SA-2020-1316)	Nessus	Huawei Local Security Checks	medium
134004	EulerOS 2.0 SP8 : openssh (EulerOS-SA-2020-1170)	Nessus	Huawei Local Security Checks	medium
701157	OpenSSH < 7.9 Access Validation Error	Nessus Network Monitor	SSH	medium
123374	openSUSE Security Update : openssh (openSUSE-2019-914)	Nessus	SuSE Local Security Checks	medium
120162	SUSE SLED15 / SLES15 Security Update : openssh (SUSE-SU-2018:3686-1)	Nessus	SuSE Local Security Checks	medium
119032	SUSE SLES11 Security Update : openssh (SUSE-SU-2018:3781-1)	Nessus	SuSE Local Security Checks	medium
119031	SUSE SLES12 Security Update : openssh (SUSE-SU-2018:3776-1)	Nessus	SuSE Local Security Checks	medium
119024	openSUSE Security Update : openssh (openSUSE-2018-1419)	Nessus	SuSE Local Security Checks	medium
118498	SUSE SLES11 Security Update : openssh (SUSE-SU-2018:3540-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-15919

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high