GHSA-232r-66cg-79px
Suggest an improvement- Source
- https://github.com/advisories/GHSA-232r-66cg-79px
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-232r-66cg-79px/GHSA-232r-66cg-79px.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-232r-66cg-79px
- Aliases
- Published
- 2018-07-12T20:29:30Z
- Modified
- 2024-10-09T20:02:38.428167Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Paramiko not properly checking authentication before processing other requests
- Details
-
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2018-7750
- https://github.com/paramiko/paramiko/issues/1175
- https://github.com/paramiko/paramiko/commit/fa29bd8446c8eab237f5187d28787727b4610516
- https://github.com/paramiko/paramiko/commit/e9dfd854bdaf8af15d7834f7502a0451d217bb8c
- https://www.exploit-db.com/exploits/45712
- https://web.archive.org/web/20190831123128/http://www.securityfocus.com/bid/103713
- https://usn.ubuntu.com/3603-2
- https://usn.ubuntu.com/3603-1
- https://lists.debian.org/debian-lts-announce/2021/12/msg00025.html
- https://lists.debian.org/debian-lts-announce/2018/10/msg00018.html
- https://github.com/pypa/advisory-database/tree/main/vulns/paramiko/PYSEC-2018-19.yaml
- https://github.com/paramiko/paramiko/blob/master/sites/www/changelog.rst
- https://github.com/paramiko/paramiko/blob/e861c7697622774071ce73b46ffe8817eacdedfa/sites/www/changelog.rst?plain=1#L759-L763
- https://github.com/paramiko/paramiko
- https://github.com/advisories/GHSA-232r-66cg-79px
- https://access.redhat.com/errata/RHSA-2018:1972
- https://access.redhat.com/errata/RHSA-2018:1525
- https://access.redhat.com/errata/RHSA-2018:1328
- https://access.redhat.com/errata/RHSA-2018:1274
- https://access.redhat.com/errata/RHSA-2018:1213
- https://access.redhat.com/errata/RHSA-2018:1125
- https://access.redhat.com/errata/RHSA-2018:1124
- https://access.redhat.com/errata/RHSA-2018:0646
- https://access.redhat.com/errata/RHSA-2018:0591
Affected packages
PyPI / paramiko
Package
- Name
- paramiko
- View open source insights on deps.dev
- Purl
- pkg:pypi/paramiko
PyPI / paramiko
Package
- Name
- paramiko
- View open source insights on deps.dev
- Purl
- pkg:pypi/paramiko
PyPI / paramiko
Package
- Name
- paramiko
- View open source insights on deps.dev
- Purl
- pkg:pypi/paramiko
PyPI / paramiko
Package
- Name
- paramiko
- View open source insights on deps.dev
- Purl
- pkg:pypi/paramiko
PyPI / paramiko
Package
- Name
- paramiko
- View open source insights on deps.dev
- Purl
- pkg:pypi/paramiko
PyPI / paramiko
Package
- Name
- paramiko
- View open source insights on deps.dev
- Purl
- pkg:pypi/paramiko
PyPI / paramiko
Package
- Name
- paramiko
- View open source insights on deps.dev
- Purl
- pkg:pypi/paramiko
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.17.6
Affected versions
0.*
0.1-bulbasaur
0.1-charmander
0.9-doduo
0.9-eevee
0.9-fearow
0.9-gyarados
0.9-horsea
0.9-ivysaur
1.*
1.0
1.1
1.2
1.3
1.3.1
1.4
1.5.1
1.5.2
1.5.4
1.6
1.6.1
1.6.2
1.6.3
1.6.4
1.7
1.7.1
1.7.2
1.7.4
1.7.5
1.7.6
1.7.7.1
1.7.7.2
1.8.0
1.8.1
1.9.0
1.10.0
1.10.1
1.10.2
1.10.3
1.10.4
1.10.5
1.10.6
1.10.7
1.11.0
1.11.1
1.11.2
1.11.3
1.11.4
1.11.5
1.11.6
1.12.0
1.12.1
1.12.2
1.12.3
1.12.4
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.14.0
1.14.1
1.14.2
1.14.3
1.15.0
1.15.1
1.15.2
1.15.3
1.15.4
1.15.5
1.16.0
1.16.1
1.16.2
1.16.3
1.17.0
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5