It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid.

Published 7 y ago 2019-03-20 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.3

v3.0 · CNA

CISA KEV

not known exploited

EPSS

1.5%

percentile 74%

Public exploits

none known

It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI authentication failure was incorrectly counted towards the maximum allowed number of password attempts.

Exploit prediction (EPSS)

1.50% probability of exploitation in the next 30 days, higher than 74% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	5.3	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`
CNA	3.0	5.3	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`
NVD	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:P/I:N/A:N`

Affected products

[UNKNOWN] dropbear

Classification

Weakness

CWE-209 Generation of Error Message Containing Sensitive Information
CWE-287 Improper Authentication

References

bugzilla.redhat.com /show_bug.cgi?id=CVE-2017-2659 · x_refsource_CONFIRM, x_transferred
secure.ucc.asn.au /hg/dropbear/rev/d7784616409a#l1.86 · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2017-2659
NVD: CVE-2017-2659

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.