5.3 / 10

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

Weakness: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

Published: 2018-08-17

Community Advisory

This section is open source, for any additional information that enhances or clarifies the official advisory above.

Improve Advisory

CVE-2018-15473 Exploits (26)

Show all exploits (+16):

CVE-2018-15473 Vulnerable Docker Environment

Vulhub is an open-source collection of Docker-ized vulnerable environments. No pre-existing knowledge of Docker is required, just execute two simple commands and you have a vulnerable environment.

Get Vulhub Docker

OpenSSH 用户名枚举漏洞(CVE-2018-15473)

OpenSSH 7.7前存在一个用户名枚举漏洞,通过该漏洞,攻击者可以判断某个用户名是否存在于目标主机中。




执行如下命令,编译及启动一个运行OpenSSH 7.7p1的容器:

docker-compose build
docker-compose up -d

环境启动后,我们在客户端执行ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null [email protected] -p20022,输入密码vulhub,即可登录到容器中。



python3 --port 20022 --userList exampleInput.txt your-ip


Research Labs

Official CVE References

View references (17)