Medium severity5.3NVD Advisory· Published Aug 21, 2018· Updated Jun 17, 2026

CVE-2018-15599

Description

The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Net::Dropbear/Net::Dropbearllm-fuzzy
Range: <=2018.76
osv-coords
pkg:rpm/opensuse/signing-party&distro=openSUSE%20Tumbleweed
Range: < 2.11-1.3

Patches

Vulnerability mechanics

References

lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2018q3/002108.htmlnvdMailing ListThird Party Advisory
lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2018q3/002109.htmlnvdMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2018/08/msg00026.htmlnvdMailing ListThird Party Advisory
old.reddit.com/r/blackhat/comments/97ywnm/openssh_username_enumeration/e4e05n2/nvdThird Party Advisory
matt.ucc.asn.au/dropbear/CHANGESnvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000