| Package | Affected versions | Patched versions |
|---|---|---|
| openssh | ≤ 7.2 |
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free