group.of.nepali.translators team mailing list archive

[Launchpad Bug Tracker <1794629@xxxxxxxxxxxxxxxxxx>]

This bug was fixed in the package openssh - 1:6.6p1-2ubuntu2.11

---------------
openssh (1:6.6p1-2ubuntu2.11) trusty-security; urgency=medium

  * SECURITY UPDATE: OpenSSH User Enumeration Vulnerability (LP: #1794629)
    - debian/patches/CVE-2018-15473.patch: delay bailout for invalid
      authenticating user until after the packet containing the request
      has been fully parsed.
    - CVE-2018-15473
  [ Leonidas S. Barbosa ]
  * SECURITY UPDATE: Privsep process chrashing via an out-of-sequence
    - debian/patches/CVE-2016-10708.patch: fix in kex.c,
      pack.c.
    - CVE-2016-10708

 -- Ryan Finnie <ryan@xxxxxxxxxx>  Sat, 13 Oct 2018 23:31:08 +0000

** Changed in: openssh (Ubuntu Trusty)
       Status: In Progress => Fix Released

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2016-10708

** Changed in: openssh (Ubuntu Xenial)
       Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1794629

Title:
  CVE-2018-15473 - User enumeration vulnerability

Status in openssh package in Ubuntu:
  In Progress
Status in openssh source package in Trusty:
  Fix Released
Status in openssh source package in Xenial:
  Fix Released
Status in openssh source package in Bionic:
  In Progress
Status in openssh source package in Cosmic:
  In Progress

Bug description:
  https://nvd.nist.gov/vuln/detail/CVE-2018-15473

  OpenSSH through 7.7 is prone to a user enumeration vulnerability due
  to not delaying bailout for an invalid authenticating user until after
  the packet containing the request has been fully parsed, related to
  auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

  Fixed in Debian: https://www.debian.org/security/2018/dsa-4280

  Currently pending triage? https://people.canonical.com/~ubuntu-
  security/cve/2018/CVE-2018-15473.html

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1794629/+subscriptions