Security Bulletin
Summary
The following vulnerability in OpenSSH has been addressed by IBM Integrated Management Module II (IMM2).
Vulnerability Details
CVEID: CVE-2018-15919
DESCRIPTION: Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability.'
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/148952 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
| IBM Integrated Management Module II (IMM2) for System x and Flex | 1AOO |
| IBM Integrated Management Module II (IMM2) for BladeCenter | 1AOO |
Remediation/Fixes
Firmware fix versions are available on Fix Central: http://www.ibm.com/support/fixcentral/
| Product(s) | Fixed Version(s) |
|
IBM Integrated Management Module II (IMM2) for System x and Flex (ibm_fw_imm2_1aoo90b-7.40_anyos_noarch) | 1AOO90B-7.40 |
|
IBM Integrated Management Module II (IMM2) for BladeCenter (ibm_fw_imm2_1aoo90b-7.40-bc_anyos_noarch) | 1AOO90B-7.40-bc |
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Change History
20 Jan 2020: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
22 January 2020
UID
ibm11282042