CVE-2017-2659

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI authentication failure was incorrectly counted towards the maximum allowed number of password attempts.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-209CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Mar 21, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-26616.1ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field wCVE-2017-26624.3A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filteCVE-2017-26637.8It was found that subscription-manager's DBus interface before 1.19.4 let unprivileged user access the com.redhat.RHSM1.Facts.GetFacts and cCVE-2017-26646.5CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portCVE-2017-26657.0The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.CVE-2017-26666.5It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjCVE-2017-26678.1Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable itCVE-2017-26686.5389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled.CVE-2017-26697.5Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the useCVE-2017-26707.5It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effecCVE-2017-26715.5The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a certain lock and consequently cannCVE-2017-26728.8A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log
CVE-2017-2659: High severity, CVSS 7.5 | Vulnix