CVE-2019-12953: Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-2018-15599.

PriorityP425medium5.3CVSS 3.1

AVNACLPRNUINSUCLINAN

EPSS

1.18%

63.8th percentile

Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-2018-15599.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	dropbear	< dropbear 2019.78-1 (bookworm)	dropbear 2019.78-1 (bookworm)
dropbear_ssh_project	dropbear_ssh	>= 0 < 2019.78-1	2019.78-1
dropbear_ssh_project	dropbear_ssh	>= 0 < 2019.78-1	2019.78-1
dropbear_ssh_project	dropbear_ssh	>= 0 < 2019.78-1	2019.78-1
dropbear_ssh_project	dropbear_ssh	>= 0 < 2019.78-1	2019.78-1
dropbear_ssh_project	dropbear_ssh	2011.54 – 2018.76	—

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

osv5.3MEDIUM

vendor_debian5.3MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.