CVE-2017-2659CWE-209

It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid

Medium · published March 20, 2019

CVSS v3.0
5.3
EPSS
2%
Percentile
74.0
In the wild
Unconfirmed
What it is

It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI authentication failure was incorrectly counted towards the maximum allowed number of password attempts.

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01505 · 74.0th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2019-03-20T20:44Z
EPSS history
Timeline
  • 20 MAR 20:44Z
    It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid
    cvelistv5