CVE-2018-15473: canonical ubuntu_linux Race Condition

CVSS: 5.9v3.1MediumModified

AliasesALPINE-CVE-2018-15473MGASA-2018-0363SUSE-SU-2018:3686-1+14 more

Published 17-08-2018Last modified 17-12-2025

Vulnerability summary

CVE-2018-15473 is a medium (CVSS 5.9) Race Condition vulnerability in canonical ubuntu_linux. EPSS estimates a 98.63% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk

53/100

0100

High · default modelHow is this calculated?

CVSS score

5.9/10

010

Medium · v3.1 (CVE.org)

EPSS score

98.63%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits4exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 2 · Related 2

SUSE-SU-2018:3540-1 USN-3809-1

Timeline

17-08-2018
PublishedVulnerability first disclosed.
17-12-2025
Last modifiedVulnerability information updated.

Description

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

CVSS metrics

8 scores · 6 sources · 3 versions

v3.15.9v3.05.3v2.05.0

EPSS trend

Probability

98.63%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 98.63% on 18-09-2026

18-09-202618-10-2026

EPSS score

98.63%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

4 found

exploit-databaseremotelinuxVerified
OpenSSH 2.3 < 7.7 - Username Enumeration
Maturity: weaponized
exploit-databaseremotelinuxVerified
OpenSSH 2.3 < 7.7 - Username Enumeration (PoC)
Maturity: weaponized
exploit-databaseremotelinuxUnverified
OpenSSH < 7.7 - User Enumeration (2)
Maturity: poc

Show all 4 exploits

MetasploitremoteUnverified
SSH Username Enumeration
auxiliary/scanner/ssh/ssh_enumusers
Maturity: poc

Weaknesses

CWE · root cause

CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected systems

Suse37 products

openssh-askpass-gnome&distro=SUSE Enterprise Storage 4< 7.2p2-74.30.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Desktop 12 SP3< 7.2p2-74.30.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Desktop 12 SP4< 7.2p2-74.30.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Module for Desktop Applications 15< 7.6p1-9.3.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server 11 SP4< 6.6p1-36.6.1

openssh-askpass-gnome&distro=SUSE Linux Enterprise Server 12 SP1-LTSS< 6.6p1-54.18.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 7.2p2-74.30.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server 12 SP2-LTSS< 7.2p2-74.30.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server 12 SP3< 7.2p2-74.30.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server 12 SP4< 7.2p2-74.30.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server 12-LTSS< 6.6p1-54.18.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4< 6.6p1-36.6.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP1< 6.6p1-54.18.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2< 7.2p2-74.30.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3< 7.2p2-74.30.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 7.2p2-74.30.1
openssh-askpass-gnome&distro=SUSE OpenStack Cloud 7< 7.2p2-74.30.1
openssh-openssl1&distro=SUSE Linux Enterprise Server 11-SECURITY< 6.6p1-19.6.1
openssh&distro=SUSE Enterprise Storage 4< 7.2p2-74.30.1
openssh&distro=SUSE Linux Enterprise Desktop 12 SP3< 7.2p2-74.30.1
openssh&distro=SUSE Linux Enterprise Desktop 12 SP4< 7.2p2-74.30.1
openssh&distro=SUSE Linux Enterprise Module for Basesystem 15< 7.6p1-9.3.1
openssh&distro=SUSE Linux Enterprise Module for Server Applications 15< 7.6p1-9.3.1
openssh&distro=SUSE Linux Enterprise Server 11 SP4< 6.6p1-36.6.1
openssh&distro=SUSE Linux Enterprise Server 12 SP1-LTSS< 6.6p1-54.18.1
openssh&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 7.2p2-74.30.1
openssh&distro=SUSE Linux Enterprise Server 12 SP2-LTSS< 7.2p2-74.30.1
openssh&distro=SUSE Linux Enterprise Server 12 SP3< 7.2p2-74.30.1
openssh&distro=SUSE Linux Enterprise Server 12 SP4< 7.2p2-74.30.1
openssh&distro=SUSE Linux Enterprise Server 12-LTSS< 6.6p1-54.18.1
openssh&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4< 6.6p1-36.6.1
openssh&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP1< 6.6p1-54.18.1
openssh&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2< 7.2p2-74.30.1
openssh&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3< 7.2p2-74.30.1
openssh&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 7.2p2-74.30.1
openssh&distro=SUSE OpenStack Cloud 7< 7.2p2-74.30.1
ssh-audit&distro=SUSE Package Hub 15 SP3< 2.5.0-bp153.2.3.1

Show all 37

Netapp14 products

Show all 14

Redhat13 products

enterprise_linux_desktop6.0 | 7.0
enterprise_linux_server6.0 | 7.0
enterprise_linux_workstation6.0 | 7.0
openssh< 0:5.3p1-124.el6_10 | < 0:7.4p1-21.el7
openssh-askpass< 0:5.3p1-124.el6_10 | < 0:7.4p1-21.el7

Show all 13

Opensuse3 products

ssh-audit&distro=openSUSE Leap 15.2< 2.5.0-lp152.2.3.1
ssh-audit&distro=openSUSE Leap 15.3< 2.5.0-bp153.2.3.1
ssh-audit&distro=openSUSE Tumbleweed< 2.5.0-1.2

Debian2 products

openssh< 1:7.7p1-4 | < 1:7.4p1-10+deb9u4 | < 1:6.7p1-5+deb8u5
debian_linuxEOL8.0 | 9.0

Alpine1 product

openssh< 7.7_p1-r4 | < 7.4_p1-r2 | < 7.5_p1-r3 | < 7.5_p1-r9 | < 7.7_p1-r3

Canonical1 product

ubuntu_linuxEOL14.04 | 16.04 | 18.04

Mageia1 product

openssh< 7.5p1-2.2.mga6

Openbsd1 product

openssh≤ 7.7

Oracle1 product

sun_zfs_storage_appliance_kit8.8.6

Siemens1 product

scalance_x204rna_firmware< 3.2.7

Ubuntu1 product

openssh< 1:6.6p1-2ubuntu2.11 | < 1:7.2p2-4ubuntu2.6 | < 1:7.6p1-4ubuntu0.1

12 vendors · 76 products

References

52 links

security.gentoo.org/glsa/201810-03Vendor AdvisoryThird Party Advisory
www.securitytracker.com/id/1041487VDB EntryBroken LinkPatchThird Party Advisory
www.exploit-db.com/exploits/45233/ExploitThird Party AdvisoryVDB Entry
bugs.debian.org/906236Issue TrackingMailing ListPatchThird Party Advisory
www.exploit-db.com/exploits/45210/ExploitThird Party AdvisoryVDB Entry
security.netapp.com/advisory/ntap-20181101-0001/Third Party Advisory
github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0PatchREPORT
usn.ubuntu.com/3809-1/Vendor AdvisoryThird Party Advisory
lists.debian.org/debian-lts-announce/2018/08/msg00022.htmlMailing ListThird Party Advisory
www.securityfocus.com/bid/105140VDB EntryBroken LinkThird Party Advisory

Show all 52 references

www.debian.org/security/2018/dsa-4280Vendor AdvisoryThird Party Advisory
www.exploit-db.com/exploits/45939/ExploitThird Party AdvisoryVDB Entry
psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0011Third Party Advisory
www.openwall.com/lists/oss-security/2018/08/15/5Mailing ListPatchThird Party AdvisoryREPORT
access.redhat.com/errata/RHSA-2019:0711Vendor AdvisoryThird Party AdvisoryAdvisory
access.redhat.com/errata/RHSA-2019:2143Vendor AdvisoryThird Party AdvisoryAdvisory
www.oracle.com/security-alerts/cpujan2020.htmlPatchThird Party Advisory
cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfPatchThird Party Advisory
security.alpinelinux.org/vuln/CVE-2018-15473Advisory
advisories.mageia.org/MGASA-2018-0363.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=23452REPORT
openwall.com/lists/oss-security/2018/08/15/5WEB
sekurak.pl/openssh-users-enumeration-cve-2018-15473/WEB
www.suse.com/support/update/announcement/2018/suse-su-20183686-1/Advisory
bugzilla.suse.com/1081947REPORT
bugzilla.suse.com/1091396REPORT
bugzilla.suse.com/1105010REPORT
bugzilla.suse.com/1106163REPORT
bugzilla.suse.com/964336REPORT
www.suse.com/security/cve/CVE-2018-15473WEB
www.suse.com/support/update/announcement/2018/suse-su-20183768-1/Advisory
www.suse.com/support/update/announcement/2018/suse-su-20183776-1/Advisory
bugzilla.suse.com/982273REPORT
www.suse.com/support/update/announcement/2018/suse-su-20183776-2/Advisory
www.suse.com/support/update/announcement/2018/suse-su-20183781-1/Advisory
www.suse.com/support/update/announcement/2018/suse-su-20183910-1/Advisory
lists.opensuse.org/archives/…Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1619063REPORT
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0711.jsonAdvisory
access.redhat.com/security/cve/CVE-2018-15473REPORT
www.cve.org/CVERecord?id=CVE-2018-15473AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2018-15473Advisory
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/indexARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1583735REPORT
bugzilla.redhat.com/show_bug.cgi?id=1712053REPORT
bugzilla.redhat.com/show_bug.cgi?id=1722446REPORT
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2143.jsonAdvisory
ubuntu.com/security/CVE-2018-15473REPORT
ubuntu.com/security/notices/USN-3809-1Advisory
security-tracker.debian.org/tracker/CVE-2018-15473Advisory
lists.opensuse.org/archives/…Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities