Detections
Analytics
Alpine: multiple openssh packages: security update to 7.7-r3 (deprecated)
medium Tenable Self-Hosted Container Security Plugin ID 400686
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an
invalid authenticating user until after the packet containing the request has been fully parsed, related
to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (CVE-2018-15473)
See Also
https://git.alpinelinux.org/aports/commit/?id=778979325b80c0140f80ecb4558828ed3e8544f4
https://git.alpinelinux.org/aports/commit/?id=c314d18b4e1c932d8670c49f265f919242b7a17b
Plugin Details
Severity: Medium
ID: 400686
Version: Revision 1.26
Type: Local
Published: 8/16/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.2
Percentile: 53.58
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 4.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2018-15473
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 5.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 8/22/2018
Vulnerability Publication Date: 8/16/2018
Exploitable With
CANVAS (CANVAS)
Reference Information
CVE: CVE-2018-15473
BID: 105140