Medium severity5.3NVD Advisory· Published Mar 21, 2019· Updated Jun 17, 2026

CVE-2017-2659

Description

It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI authentication failure was incorrectly counted towards the maximum allowed number of password attempts.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mkj/Dropbearinferred
Range: <2013.59
Dropbear SSH Project/Dropbear SSH
cpe:2.3:a:dropbear_ssh_project:dropbear_ssh:*:*:*:*:*:*:*:*
Range: <2013.59
Net::Dropbear/Net::Dropbearllm-fuzzy
Range: <2013.59

Patches

Vulnerability mechanics

References

bugzilla.redhat.com/show_bug.cginvdIssue TrackingPatchThird Party Advisory
secure.ucc.asn.au/hg/dropbear/rev/d7784616409anvdPatchThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000