<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div>On Mon 20/8/2018, at 11:55 pm, Matt Johnston <<a href="mailto:matt@ucc.asn.au" class="">matt@ucc.asn.au</a>> wrote:<br class=""><blockquote type="cite" class=""><br class=""><div class=""><div class="">I can confirm Dropbear has the same problem, probably all versions. I should have a patch in the next couple of days.<br class=""><br class="">This allows someone to remotely know whether a particular username exists or not on a server. In some circumstances that could be a problem, though by itself it doesn't allow exploitation of a server.<br class=""></div></div></blockquote></div><br class=""><div class="">This should be fixed by <a href="https://secure.ucc.asn.au/hg/dropbear/rev/5d2d1021ca00" class="">https://secure.ucc.asn.au/hg/dropbear/rev/5d2d1021ca00</a> , a CVE number is CVE-2018-15599</div><div class=""><br class=""></div><div class="">Cheers,</div><div class="">Matt</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><span style="font-family: Monaco; font-size: 12px;" class=""><br class=""></span></div></body></html>