Update SSH user enum templates

SSH header structure:
SSH-protoversion-softwareversion[SPcomments]CRLF

see: https://datatracker.ietf.org/doc/html/rfc4253#section-4.2

cves/2016/CVE-2016-6210.yaml

@@ -1,15 +1,16 @@
 id: CVE-2016-6210
 
 info:
-  name: OpenSSH 5.3 Detection
-  author: iamthefrogy
+  name: OpenSSH username enumeration < v7.3
+  author: iamthefrogy,forgedhallpass
   severity: medium
   tags: network,openssh
-  description: OpenSSH 5.3 is vulnerable to username enumeration and DoS vulnerabilities.
+  description: OpenSSH before 7.3 is vulnerable to username enumeration and DoS vulnerabilities.
   reference:
     - http://seclists.org/fulldisclosure/2016/Jul/51
     - https://security-tracker.debian.org/tracker/CVE-2016-6210
     - http://openwall.com/lists/oss-security/2016/08/01/2
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-6210
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
     cvss-score: 5.9
@@ -21,6 +22,11 @@ network:
       - "{{Hostname}}"
       - "{{Hostname}}:22"
     matchers:
-      - type: word
-        words:
-          - "SSH-2.0-OpenSSH_5.3"
+      - type: regex
+        regex:
+          - '(?i)SSH-2.0-OpenSSH_(?:[1-6][^\d][^\r]+|7\.[0-2][^\d][^\r]+)'
+
+    extractors:
+      - type: regex
+        regex:
+          - '(?i)SSH-2.0-OpenSSH_[^\r]+'

cves/2018/CVE-2018-15473.yaml

@@ -1,8 +1,8 @@
 id: CVE-2018-15473
 
 info:
-  name: OpenSSH Username Enumeration
-  author: r3dg33k,daffainfo
+  name: OpenSSH Username Enumeration <= v7.7
+  author: r3dg33k,daffainfo,forgedhallpass
   severity: medium
   description: OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
   reference: https://nvd.nist.gov/vuln/detail/CVE-2018-15473
@@ -21,9 +21,9 @@ network:
     matchers:
       - type: regex
         regex:
-          - 'SSH-2.0-OpenSSH_[1-7]'
+          - '(?i)SSH-2.0-OpenSSH_(?:[1-6][^\d][^\r]+|7\.[0-7][^\d][^\r]+)'
 
     extractors:
       - type: regex
         regex:
-          - 'SSH-2.0-OpenSSH_([0-9.]+)'
+          - '(?i)SSH-2.0-OpenSSH_[^\r]+'