CVE-2018-15919

A vulnerability was found in OpenSSH Server, where failed GSSAPI authentication attempts elicit different responses depending on whether the target username exists, a remote attacker could exploit this behavior to enumerate valid usernames on a system, potentially aiding in further attacks. This issue could be leveraged in reconnaissance efforts to identify existing user accounts.

This vulnerability is rated as moderate because OpenSSH Server responds differently to failed GSSAPI authentication attempts based on whether a target username exists, while this does not directly compromise system integrity, it could facilitate further attacks such as brute-force or credential-stuffing attempts.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If GSSAPI Authentication is not required, this flaw can be mitigated by changing the global configuration in /etc/ssh/sshd_config from GSSAPIAuthentication yes to GSSAPIAuthentication no.