Debian Security Advisory DSA 4280-1 (openssh - security update)

Dariusz Tytko, Michal Sajdak and Qualys Security discovered that OpenSSH, an implementation of the SSH protocol suite, was prone to a user enumeration vulnerability. This would allow a remote attacker to check whether a specific user account existed on the target server.

openssh on Debian Linux

This check tests the installed software version using the apt package manager.

For the stable distribution (stretch), this problem has been fixed in version 1:7.4p1-10+deb9u4. We recommend that you upgrade your openssh packages. For the detailed security status of openssh please refer to its security tracker page linked in the references.