p PatchFirst

CVE-2017-2659

CVE-2017-2659

This page contains facts from public vulnerability sources. Check the original advisory before updating.

It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI authentication failure was incorrectly counted towards the maximum allowed number of password attempts.

CVSS 5.3 · Medium · EPSS 1.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • dropbear

    Versions
    • fixed in 2013.59: Affected

    No fix published

  • dropbear Debian:12

    Affected ranges
    • ECOSYSTEM: < 2013.60-1

    Update to 2013.60-1

  • dropbear Debian:13

    Affected ranges
    • ECOSYSTEM: < 2013.60-1

    Update to 2013.60-1

  • dropbear Debian:14

    Affected ranges
    • ECOSYSTEM: < 2013.60-1

    Update to 2013.60-1

Original sources

Check your server →