vulnwire
9.8crit

CVE-2018-7750in critical feed1 exploit

Paramiko not properly checking authentication before processing other requests

Also known as GHSA-232r-66cg-79px, PYSEC-2018-19

Published 8 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
27.1%
percentile 98%
Public exploits
1
Exploit-DB

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.

Exploit prediction (EPSS)

27.11% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

  • EDB-45712 Paramiko 2.4.1 - Authentication Bypass · remote · 2018-10-29

CVSS scores

Assigned byVersionScoreVector
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
pypiparamiko
>=2.0.0, <2.0.8
>=2.1.0, <2.1.5
>=2.2.0, <2.2.3
>=2.3.0, <2.3.2
>=2.4.0, <2.4.1
>=1.18.0, <1.18.5
<1.17.6
2.0.8
2.1.5
2.2.3
2.3.2
2.4.1
1.18.5
1.17.6

Classification

Weakness

References

  • access.redhat.com /errata/RHSA-2018:1124 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • exploit-db.com /exploits/45712/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • github.com /paramiko/paramiko/issues/1175 · x_refsource_CONFIRM, x_transferred
  • access.redhat.com /errata/RHSA-2018:1125 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1972 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1274 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.debian.org /debian-lts-announce/2018/10/msg00018.html · mailing-list, x_refsource_MLIST, x_transferred
  • usn.ubuntu.com /3603-2/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • access.redhat.com /errata/RHSA-2018:0646 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1213 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • usn.ubuntu.com /3603-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • access.redhat.com /errata/RHSA-2018:1525 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1328 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:0591 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securityfocus.com /bid/103713 · vdb-entry, x_refsource_BID, x_transferred
  • github.com /paramiko/paramiko/commit/fa29bd8446c8eab237f5187d28787727b4610516 · x_refsource_CONFIRM, x_transferred
  • github.com /paramiko/paramiko/blob/master/sites/www/changelog.rst · x_refsource_CONFIRM, x_transferred
  • lists.debian.org /debian-lts-announce/2021/12/msg00025.html · mailing-list, x_refsource_MLIST, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2018-7750 · advisory
  • github.com /paramiko/paramiko/commit/e9dfd854bdaf8af15d7834f7502a0451d217bb8c · web
  • exploit-db.com /exploits/45712 · web
  • web.archive.org /web/20190831123128/http://www.securityfocus.com/bid/103713 · web
  • usn.ubuntu.com /3603-2 · web
  • usn.ubuntu.com /3603-1 · web
  • github.com /pypa/advisory-database/tree/main/vulns/paramiko/PYSEC-2018-19.yaml · web
  • github.com /paramiko/paramiko/blob/e861c7697622774071ce73b46ffe8817eacdedfa/sites/www/changelog.rst?p · web
  • github.com /paramiko/paramiko · package
  • github.com /advisories/GHSA-232r-66cg-79px · advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.