PYSEC-2018-19
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/paramiko/PYSEC-2018-19.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2018-19
- Aliases
- Published
- 2018-03-13T18:29:00Z
- Modified
- 2023-11-08T04:00:23.504429Z
- Summary
- [none]
- Details
-
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
- References
-
- https://github.com/paramiko/paramiko/commit/fa29bd8446c8eab237f5187d28787727b4610516
- https://github.com/paramiko/paramiko/blob/master/sites/www/changelog.rst
- https://github.com/paramiko/paramiko/issues/1175
- https://usn.ubuntu.com/3603-2/
- https://access.redhat.com/errata/RHSA-2018:0591
- https://usn.ubuntu.com/3603-1/
- https://access.redhat.com/errata/RHSA-2018:0646
- https://access.redhat.com/errata/RHSA-2018:1125
- https://access.redhat.com/errata/RHSA-2018:1124
- https://access.redhat.com/errata/RHSA-2018:1213
- http://www.securityfocus.com/bid/103713
- https://access.redhat.com/errata/RHSA-2018:1274
- https://access.redhat.com/errata/RHSA-2018:1328
- https://access.redhat.com/errata/RHSA-2018:1525
- https://access.redhat.com/errata/RHSA-2018:1972
- https://lists.debian.org/debian-lts-announce/2018/10/msg00018.html
- https://www.exploit-db.com/exploits/45712/
- https://github.com/advisories/GHSA-232r-66cg-79px
Affected packages
PyPI / paramiko
Package
- Name
- paramiko
- View open source insights on deps.dev
- Purl
- pkg:pypi/paramiko
Affected ranges
- Type
- GIT
- Repo
- https://github.com/paramiko/paramiko
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.17.6Introduced2.0.0Fixed2.0.8Introduced2.1.0Fixed2.1.5Introduced2.2.0Fixed2.2.3Introduced2.3.0Fixed2.3.2Introduced1.18.0Fixed1.18.5
Affected versions
0.*
0.1-bulbasaur
0.1-charmander
0.9-doduo
0.9-eevee
0.9-fearow
0.9-gyarados
0.9-horsea
0.9-ivysaur
1.*
1.0
1.1
1.2
1.3
1.3.1
1.4
1.5.1
1.5.2
1.5.4
1.6
1.6.1
1.6.2
1.6.3
1.6.4
1.7
1.7.1
1.7.2
1.7.4
1.7.5
1.7.6
1.7.7.1
1.7.7.2
1.8.0
1.8.1
1.9.0
1.10.0
1.10.1
1.10.2
1.10.3
1.10.4
1.10.5
1.10.6
1.10.7
1.11.0
1.11.1
1.11.2
1.11.3
1.11.4
1.11.5
1.11.6
1.12.0
1.12.1
1.12.2
1.12.3
1.12.4
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.14.0
1.14.1
1.14.2
1.14.3
1.15.0
1.15.1
1.15.2
1.15.3
1.15.4
1.15.5
1.16.0
1.16.1
1.16.2
1.16.3
1.17.0
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.2.0
2.2.1
2.2.2
2.3.0
2.3.1