What is CVE-2003-0190?

CVE-2003-0190 is a vulnerability in OpenBSD OpenSSH, classified under Observable Discrepancy. Published 2003-05-12.

Is CVE-2003-0190 known to be exploited?

11 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in OpenBSD OpenSSH

CVE-2003-0190

OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.

Published 2003-05-12 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 5.0 (Medium). Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.768 (99.5th percentile), scored 2026-10-29.

High probability of exploitation in the next 30 days — patch promptly. 100th percentile — 99.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.768 · newest: 0.768 · change: 0.000

Affected products

Weakness classification (CWE)

CWE-203 — Observable Discrepancy

Public proof-of-concept exploits

References

www.redhat.com/support/errata/RHSA-2003-222.html (vendor-advisory, Broken Link)
marc.info/ (mailing-list, Third Party Advisory)
www.securityfocus.com/bid/7467 (Exploit, Patch, VDB Entry, Third Party Advisory, vdb-entry, Broken Link, Vendor Advisory)
marc.info/ (mailing-list, Third Party Advisory)
www.redhat.com/support/errata/RHSA-2003-224.html (vendor-advisory, Broken Link)
oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:445 (signature, vdb-entry, Broken Link)
lab.mediaservice.net/advisory/2003-01-openssh.txt (Broken Link)
www.turbolinux.com/security/TLSA-2003-31.txt (vendor-advisory, Broken Link)
lists.grok.org.uk/pipermail/full-disclosure/2003-April/004815.html (mailing-list, Broken Link)
cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf (Third Party Advisory)

Frequently asked questions

What is CVE-2003-0190?: CVE-2003-0190 is a vulnerability in OpenBSD OpenSSH, classified under Observable Discrepancy. Published 2003-05-12.
Is CVE-2003-0190 known to be exploited?: 11 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.