Skip to content
Fencer Intel
medium 5.3

CVE-2018-15599 json

The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because usern…

published 2018-08-21 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-7472

cvss
5.3
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.7%
EPSS 2.7% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase.

Patch / fix

  • dropbear Debian 14, Debian 13, Debian 12 2018.76-4

debian advisories DEBIAN-CVE-2018-15599

  • signing-party openSUSE Tumbleweed 2.11-1.3

opensuse advisories openSUSE-SU-2024:11383-1

  • dropbear Alpine 3.24, Alpine 3.23, Alpine 3.22 +15 more 2018.76-r2
  • dropbear Alpine 3.6, Alpine 3.5 2017.75-r1

alpine advisories ALPINE-CVE-2018-15599

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-15599 updated cvss 5.3

dropbear: User enumeration via malformed packets in authentication requests

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.69% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.