CVE-2009-1273

pam_ssh 1.92 and possibly other versions, as used when PAM is compiled with USE=ssh, generates different error messages depending on whether the username is…

published April 8, 2009

CVSS
—
EPSS
1%
Percentile
70.3
In the wild
Unconfirmed
What it is

pam_ssh 1.92 and possibly other versions, as used when PAM is compiled with USE=ssh, generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01305 · 70.3th percentile
Published
2009-04-08T18:00Z
EPSS history
Timeline
  • 08 APR 18:00Z
    pam_ssh 1.92 and possibly other versions, as used when PAM is compiled with USE=ssh, generates different error messages depending on whether the username is…
    cvelistv5