CVE-2018-1000805 — Incorrect Authorization in Paramiko

CWE-863 — Incorrect AuthorizationCWE-305 — Authentication Bypass by Primary WeaknessCWE-732 — Incorrect Permission Assignment14 documents8 sources
Severity
8.8HIGHNVD
EPSS
0.4%
top 37.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
ParamikoCanonical Ubuntu LinuxDebian Linux+8 more
Timeline
PublishedOct 8
Latest updateOct 22

Description

Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages8 packages

▶PyPIparamiko/paramiko2.4.0 — 2.4.2+4
▶Debianparamiko/paramiko< 2.4.2-0.1+3
▶NVDparamiko/paramiko7 versions+6

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 12.04, 14.04, 16.04, 18.04, 18.10, Enterprise Linux 6.4, 6.5, 6.6, 7.6, 6.7

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Paramiko Authentication Bypass vulnerability↗2018-10-10
▶
GHSA
Paramiko Authentication Bypass vulnerability↗2018-10-10
▶
CVEList
CVE-2018-1000805: Paramiko version 2↗2018-10-08
▶
OSV
CVE-2018-1000805: Paramiko version 2↗2018-10-08
▶

📋Vendor Advisories

5
Ubuntu
Paramiko vulnerability↗2018-10-22
▶
Ubuntu
Paramiko vulnerability↗2018-10-17
▶
Ubuntu
Paramiko vulnerability↗2018-10-17
▶
Red Hat
python-paramiko: Authentication bypass in auth_handler.py↗2018-09-07
▶
Debian
CVE-2018-1000805: paramiko - Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a In...↗2018
▶

💬Community

4
Bugzilla
CVE-2018-1000805 python-paramiko: Authentication bypass in auth_handler.py↗2018-10-09
▶
Bugzilla
CVE-2018-1000805 python-paramiko: Authentication bypass in auth_handler.py [fedora-all]↗2018-10-09
▶
Bugzilla
CVE-2018-1000805 python-paramiko: Authentication bypass in auth_handler.py [openstack-rdo]↗2018-10-09
▶
Bugzilla
CVE-2018-1000805 python-paramiko: Authentication bypass in auth_handler.py [epel-all]↗2018-10-09
▶
CVE-2018-1000805 — Incorrect Authorization in Paramiko | cvebase