diff -Nru openssh-7.6p1/debian/changelog openssh-7.6p1/debian/changelog
--- openssh-7.6p1/debian/changelog	2018-02-10 02:31:46.000000000 +0000
+++ openssh-7.6p1/debian/changelog	2018-10-13 23:23:54.000000000 +0000
@@ -1,3 +1,13 @@
+openssh (1:7.6p1-4ubuntu0.1) bionic-security; urgency=medium
+
+  * SECURITY UPDATE: OpenSSH User Enumeration Vulnerability (LP: #1794629)
+    - debian/patches/CVE-2018-15473.patch: delay bailout for invalid
+      authenticating user until after the packet containing the request
+      has been fully parsed.
+    - CVE-2018-15473
+
+ -- Ryan Finnie <ryan@finnie.org>  Sat, 13 Oct 2018 23:23:54 +0000
+
 openssh (1:7.6p1-4) unstable; urgency=medium
 
   * Move VCS to salsa.debian.org.
diff -Nru openssh-7.6p1/debian/patches/CVE-2018-15473.patch openssh-7.6p1/debian/patches/CVE-2018-15473.patch
--- openssh-7.6p1/debian/patches/CVE-2018-15473.patch	1970-01-01 00:00:00.000000000 +0000
+++ openssh-7.6p1/debian/patches/CVE-2018-15473.patch	2018-10-13 23:22:23.000000000 +0000
@@ -0,0 +1,134 @@
+Backport of:
+
+From 779974d35b4859c07bc3cb8a12c74b43b0a7d1e0 Mon Sep 17 00:00:00 2001
+From: djm <djm@openbsd.org>
+Date: Tue, 31 Jul 2018 03:10:27 +0000
+Subject: [PATCH] =?UTF-8?q?delay=20bailout=20for=20invalid=20authenticatin?=
+ =?UTF-8?q?g=20user=20until=20after=20the=20packet=20containing=20the=20re?=
+ =?UTF-8?q?quest=20has=20been=20fully=20parsed.=20Reported=20by=20Dariusz?=
+ =?UTF-8?q?=20Tytko=20and=20Micha=C5=82=20Sajdak;=20ok=20deraadt?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+delay bailout for invalid authenticating user until after the packet
+containing the request has been fully parsed.
+
+---
+ auth2-gss.c       |    9 ++++++---
+ auth2-hostbased.c |    9 +++++----
+ auth2-pubkey.c    |   21 ++++++++++++++-------
+ 3 files changed, 25 insertions(+), 14 deletions(-)
+
+--- a/auth2-gss.c
++++ b/auth2-gss.c
+@@ -104,9 +104,6 @@
+ 	u_int len;
+ 	u_char *doid = NULL;
+ 
+-	if (!authctxt->valid || authctxt->user == NULL)
+-		return (0);
+-
+ 	mechs = packet_get_int();
+ 	if (mechs == 0) {
+ 		debug("Mechanism negotiation is not supported");
+@@ -137,6 +134,12 @@
+ 		return (0);
+ 	}
+ 
++	if (!authctxt->valid || authctxt->user == NULL) {
++		debug2("%s: disabled because of invalid user", __func__);
++		free(doid);
++		return (0);
++	}
++
+ 	if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) {
+ 		if (ctxt != NULL)
+ 			ssh_gssapi_delete_ctx(&ctxt);
+--- a/auth2-hostbased.c
++++ b/auth2-hostbased.c
+@@ -67,10 +67,6 @@
+ 	size_t alen, blen, slen;
+ 	int r, pktype, authenticated = 0;
+ 
+-	if (!authctxt->valid) {
+-		debug2("%s: disabled because of invalid user", __func__);
+-		return 0;
+-	}
+ 	/* XXX use sshkey_froms() */
+ 	if ((r = sshpkt_get_cstring(ssh, &pkalg, &alen)) != 0 ||
+ 	    (r = sshpkt_get_string(ssh, &pkblob, &blen)) != 0 ||
+@@ -118,6 +114,11 @@
+ 		goto done;
+ 	}
+ 
++       if (!authctxt->valid || authctxt->user == NULL) {
++               debug2("%s: disabled because of invalid user", __func__);
++               goto done;
++       }
++
+ 	service = ssh->compat & SSH_BUG_HBSERVICE ? "ssh-userauth" :
+ 	    authctxt->service;
+ 	if ((b = sshbuf_new()) == NULL)
+--- a/auth2-pubkey.c
++++ b/auth2-pubkey.c
+@@ -79,16 +79,12 @@
+ 	Authctxt *authctxt = ssh->authctxt;
+ 	struct sshbuf *b;
+ 	struct sshkey *key = NULL;
+-	char *pkalg, *userstyle = NULL, *fp = NULL;
+-	u_char *pkblob, *sig, have_sig;
++	char *pkalg = NULL, *userstyle = NULL, *fp = NULL;
++	u_char *pkblob = NULL, *sig = NULL, have_sig;
+ 	size_t blen, slen;
+ 	int r, pktype;
+ 	int authenticated = 0;
+ 
+-	if (!authctxt->valid) {
+-		debug2("%s: disabled because of invalid user", __func__);
+-		return 0;
+-	}
+ 	if ((r = sshpkt_get_u8(ssh, &have_sig)) != 0)
+ 		fatal("%s: sshpkt_get_u8 failed: %s", __func__, ssh_err(r));
+ 	if (ssh->compat & SSH_BUG_PKAUTH) {
+@@ -166,6 +162,12 @@
+ 				fatal("%s: sshbuf_put_string session id: %s",
+ 				    __func__, ssh_err(r));
+ 		}
++		if (!authctxt->valid || authctxt->user == NULL) {
++			debug2("%s: disabled because of invalid user",
++			    __func__);
++			buffer_free(&b);
++			goto done;
++		}
+ 		/* reconstruct packet */
+ 		xasprintf(&userstyle, "%s%s%s", authctxt->user,
+ 		    authctxt->style ? ":" : "",
+@@ -202,7 +204,6 @@
+ 			authenticated = 1;
+ 		}
+ 		sshbuf_free(b);
+-		free(sig);
+ 		auth2_record_key(authctxt, authenticated, key);
+ 	} else {
+ 		debug("%s: test whether pkalg/pkblob are acceptable for %s %s",
+@@ -210,6 +211,11 @@
+ 		if ((r = sshpkt_get_end(ssh)) != 0)
+ 			fatal("%s: %s", __func__, ssh_err(r));
+ 
++               if (!authctxt->valid || authctxt->user == NULL) {
++                       debug2("%s: disabled because of invalid user",
++                           __func__);
++                       goto done;
++               }
+ 		/* XXX fake reply and always send PK_OK ? */
+ 		/*
+ 		 * XXX this allows testing whether a user is allowed
+@@ -238,6 +244,7 @@
+ 	free(pkalg);
+ 	free(pkblob);
+ 	free(fp);
++	free(sig);
+ 	return authenticated;
+ }
+ 
diff -Nru openssh-7.6p1/debian/patches/series openssh-7.6p1/debian/patches/series
--- openssh-7.6p1/debian/patches/series	2018-01-25 23:13:31.000000000 +0000
+++ openssh-7.6p1/debian/patches/series	2018-10-13 23:23:22.000000000 +0000
@@ -28,3 +28,4 @@
 seccomp-s390-ioctl-ep11-crypto.patch
 permitopen-argument-handling.patch
 fix-regress-putty-transfer.patch
+CVE-2018-15473.patch