CVE-2018-7750
published 2018-03-13CVE-2018-7750: transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3…
PriorityP274critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
27.07%
97.8th percentile
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | paramiko | < paramiko 2.4.2-0.1 (bookworm) | paramiko 2.4.2-0.1 (bookworm) |
| paramiko | paramiko | < 1.17.6 | 1.17.6 |
| paramiko | paramiko | — | — |
| paramiko | paramiko | >= 0 < 2.4.2-0.1 | 2.4.2-0.1 |
| paramiko | paramiko | >= 0 < 2.4.2-0.1 | 2.4.2-0.1 |
| paramiko | paramiko | >= 0 < 2.4.2-0.1 | 2.4.2-0.1 |
| paramiko | paramiko | >= 0 < 2.4.2-0.1 | 2.4.2-0.1 |
| paramiko | paramiko | >= 0 < 1.17.6 | 1.17.6 |
| paramiko | paramiko | >= 1.18.0 < 1.18.5 | 1.18.5 |
| paramiko | paramiko | >= 1.18.0 < 1.18.5 | 1.18.5 |
| paramiko | paramiko | >= 2.0.0 < 2.0.8 | 2.0.8 |
| paramiko | paramiko | >= 2.0.0 < 2.0.8 | 2.0.8 |
| paramiko | paramiko | >= 2.1.0 < 2.1.5 | 2.1.5 |
| paramiko | paramiko | >= 2.1.0 < 2.1.5 | 2.1.5 |
| paramiko | paramiko | >= 2.2.0 < 2.2.3 | 2.2.3 |
| paramiko | paramiko | >= 2.2.0 < 2.2.3 | 2.2.3 |
| paramiko | paramiko | >= 2.3.0 < 2.3.2 | 2.3.2 |
| paramiko | paramiko | >= 2.3.0 < 2.3.2 | 2.3.2 |
| paramiko | paramiko | >= 2.4.0 < 2.4.1 | 2.4.1 |
| redhat | ansible_engine | — | — |
| redhat | ansible_engine | — | — |
| redhat | cloudforms | — | — |
| redhat | cloudforms | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for unauthenticated SFTP channel-open requests on SSH servers using Paramiko's server-side implementation (paramiko.ServerInterface subclasses); legitimate clients should always complete authentication before opening channels. ↗
- →Flag any SSH session where channel-open or SFTP subsystem requests are observed in server logs before any authentication success event for the same session. ↗
- ·This vulnerability only affects Paramiko when used in server-side mode (e.g., subclassing paramiko.ServerInterface). Client-only deployments are NOT vulnerable. ↗
- ·Affected version ranges: Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1. ↗
- ·Nutanix AOS & Prism versions below 5.5.5 (LTS) and 5.8.1 (STS) are specifically affected via their SFTP server component on port 2222. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Paramiko not properly checking authentication before processing other requests
ghsa·2018-07-12
CVE-2018-7750 [CRITICAL] CWE-287 Paramiko not properly checking authentication before processing other requests
Paramiko not properly checking authentication before processing other requests
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
OSV
Paramiko not properly checking authentication before processing other requests
osv·2018-07-12
CVE-2018-7750 [CRITICAL] Paramiko not properly checking authentication before processing other requests
Paramiko not properly checking authentication before processing other requests
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
OSV
CVE-2018-7750: transport
osv·2018-03-13·CVSS 9.8
CVE-2018-7750 [CRITICAL] CVE-2018-7750: transport
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
Ubuntu
Paramiko vulnerability
vendor_ubuntu·2018-03-20
CVE-2018-7750 Paramiko vulnerability
Title: Paramiko vulnerability
Summary: Paramiko could be made to run programs if it received specially
crafted network traffic.
USN-3603-1 fixed a vulnerability in Paramiko. This update provides
the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Matthijs Kooijman discovered that Paramiko's SSH server implementation
did not properly require authentication before processing requests. An
unauthenticated remote attacker could possibly use this to execute
arbitrary code.
Instructions: After a standard system update you need to restart any applications
using Paramiko's server implementation to make all the necessary changes.
Ubuntu
Paramiko vulnerability
vendor_ubuntu·2018-03-20
CVE-2018-7750 Paramiko vulnerability
Title: Paramiko vulnerability
Summary: Paramiko could be made to run programs if it received specially
crafted network traffic.
Matthijs Kooijman discovered that Paramiko's SSH server implementation
did not properly require authentication before processing requests. An
unauthenticated remote attacker could possibly use this to execute
arbitrary code.
Instructions: After a standard system update you need to restart any applications
using Paramiko's server implementation to make all the necessary changes.
Red Hat
python-paramiko: Authentication bypass in transport.py
vendor_redhat·2018-03-13·CVSS 9.8
CVE-2018-7750 [CRITICAL] CWE-287 python-paramiko: Authentication bypass in transport.py
python-paramiko: Authentication bypass in transport.py
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
It was found that when acting as an SSH server, paramiko did not properly check whether authentication is completed before processing other requests. A customized SSH client could use this to bypass authentication when accessing any resources controlled by paramiko.
Statement: This flaw is a user authentication bypass in the SSH Server functionality
Debian
CVE-2018-7750: paramiko - transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x ...
vendor_debian·2018·CVSS 9.8
CVE-2018-7750 [CRITICAL] CVE-2018-7750: paramiko - transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x ...
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
Scope: local
bookworm: resolved (fixed in 2.4.2-0.1)
bullseye: resolved (fixed in 2.4.2-0.1)
forky: resolved (fixed in 2.4.2-0.1)
sid: resolved (fixed in 2.4.2-0.1)
trixie: resolved (fixed in 2.4.2-0.1)
No detection rules found.
Exploit-DB
Nutanix AOS & Prism < 5.5.5 (LTS) / < 5.8.1 (STS) - SFTP Authentication Bypass
exploitdb·2018-10-30·CVSS 9.8
CVE-2018-7750 [CRITICAL] Nutanix AOS & Prism < 5.5.5 (LTS) / < 5.8.1 (STS) - SFTP Authentication Bypass
Nutanix AOS & Prism < 5.5.5 (LTS) / < 5.8.1 (STS) - SFTP Authentication Bypass
---
# Exploit Title: Nutanix AOS & Prism - SFTP Authentication Bypass
# Date: 2018-10-27
# Exploit Author: Adam Brown
# Vendor Homepage: https://www.nutanix.org
# Software Link: https://www.nutanix.com/products/software-options/
# Version: < 5.5.5 (LTS), < 5.8.1 (STS)
# Tested on: Acropolis Operating System
# CVE : Related to CVE-2018-7750
#
# This PoC is based on discussions found at the following blog post:
# https://coffeegist.com/security/paramiko-ssh-authentication-bypass-in-nutanix/
# TLDR, the Acropolis SFTP server doesn't check if the client has completed the
# authentication step before allowing the client to open channels. The PoC below
# connects to the acropolis SFTP server, and lists the root dire
Exploit-DB
Paramiko 2.4.1 - Authentication Bypass
exploitdb·2018-10-29·CVSS 9.8
CVE-2018-7750 [CRITICAL] Paramiko 2.4.1 - Authentication Bypass
Paramiko 2.4.1 - Authentication Bypass
---
# Exploit Title: Paramiko 2.4.1 - Authentication Bypass
# Date: 2018-10-27
# Exploit Author: Adam Brown
# Vendor Homepage: https://www.paramiko.org
# Software Link: https://github.com/paramiko/paramiko/tree/v1.15.2
# Version: < 1.17.6, 1.18.x < 1.18.5, 2.0.x < 2.0.8, 2.1.x < 2.1.5, 2.2.x < 2.2.3, 2.3.x < 2.3.2, and 2.4.x < 2.4.1
# Tested on: Multiple
# CVE : CVE-2018-7750
# This PoC is based on discussions found at the following github issue:
# https://github.com/paramiko/paramiko/issues/1175
# TLDR, Paramiko doesn't check if the client has completed the authentication step
# before allowing the client to open channels. The PoC below connects to an SFTP
# server, and lists the root directory without authenticating. Slight modification
# is requ
arXiv
Microservice Vulnerability Analysis: A Literature Review with Empirical Insights
arxiv_fulltext·2024-07-31
Microservice Vulnerability Analysis: A Literature Review with Empirical Insights
Microservice Vulnerability Analysis: A Literature Review with Empirical Insights
Raveen Kanishka Jayalath*
University of Adelaide, Australia
[email protected]
Hussain Ahmad* *Authors contributed equally to this work. Corresponding author.
University of Adelaide, Australia
[email protected]
Diksha Goel
CSIRO's Data61, Australia
[email protected]
3cmMuhammad Shuja Syed
3cmSLB, USA
[email protected]
Faheem Ullah
University of Adelaide, Australia
[email protected]
plain
## Abstract
Microservice architectures are revolutionizing both small businesses and large corporations, igniting a new era of innovation with their exceptional advantages in maintainability, reusability, and scalability. However, these benefits come w
Bugzilla
CVE-2018-7750 python-paramiko: Authentication bypass in transport.py
bugzilla·2018-03-16·CVSS 9.8
CVE-2018-7750 [CRITICAL] CVE-2018-7750 python-paramiko: Authentication bypass in transport.py
CVE-2018-7750 python-paramiko: Authentication bypass in transport.py
A flaw was found in the implementation of transport.py in Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
Upstream Issue:
https://github.com/paramiko/paramiko/issues/1175
Upstream Patch:
https://github.com/paramiko/paramiko/commit/fa29bd8446c8eab237f5187d28787727b4610516
Discussion:
Created python-paramiko tracking bugs for this issue:
Affects: fedora-all [bug 1557131]
Affects: epel-all [bug 1557132]
---
Created python-par
Bugzilla
CVE-2018-7750 python-paramiko: Authentication bypass in transport.py [fedora-all]
bugzilla·2018-03-16·CVSS 9.8
CVE-2018-7750 [CRITICAL] CVE-2018-7750 python-paramiko: Authentication bypass in transport.py [fedora-all]
CVE-2018-7750 python-paramiko: Authentication bypass in transport.py [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported vers
Bugzilla
CVE-2018-7750 python-paramiko: Authentication bypass in transport.py [epel-all]
bugzilla·2018-03-16·CVSS 9.8
CVE-2018-7750 [CRITICAL] CVE-2018-7750 python-paramiko: Authentication bypass in transport.py [epel-all]
CVE-2018-7750 python-paramiko: Authentication bypass in transport.py [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions
Bugzilla
CVE-2018-7750 python-paramiko: Authentication bypass in transport.py [openstack-rdo]
bugzilla·2018-03-16·CVSS 9.8
CVE-2018-7750 [CRITICAL] CVE-2018-7750 python-paramiko: Authentication bypass in transport.py [openstack-rdo]
CVE-2018-7750 python-paramiko: Authentication bypass in transport.py [openstack-rdo]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of openstack-rdo.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
In RHEL this has been fixed i
http://www.securityfocus.com/bid/103713https://access.redhat.com/errata/RHSA-2018:0591https://access.redhat.com/errata/RHSA-2018:0646https://access.redhat.com/errata/RHSA-2018:1124https://access.redhat.com/errata/RHSA-2018:1125https://access.redhat.com/errata/RHSA-2018:1213https://access.redhat.com/errata/RHSA-2018:1274https://access.redhat.com/errata/RHSA-2018:1328https://access.redhat.com/errata/RHSA-2018:1525https://access.redhat.com/errata/RHSA-2018:1972https://github.com/paramiko/paramiko/blob/master/sites/www/changelog.rsthttps://github.com/paramiko/paramiko/commit/fa29bd8446c8eab237f5187d28787727b4610516https://github.com/paramiko/paramiko/issues/1175https://lists.debian.org/debian-lts-announce/2018/10/msg00018.htmlhttps://lists.debian.org/debian-lts-announce/2021/12/msg00025.htmlhttps://usn.ubuntu.com/3603-1/https://usn.ubuntu.com/3603-2/https://www.exploit-db.com/exploits/45712/http://www.securityfocus.com/bid/103713https://access.redhat.com/errata/RHSA-2018:0591https://access.redhat.com/errata/RHSA-2018:0646https://access.redhat.com/errata/RHSA-2018:1124https://access.redhat.com/errata/RHSA-2018:1125https://access.redhat.com/errata/RHSA-2018:1213https://access.redhat.com/errata/RHSA-2018:1274https://access.redhat.com/errata/RHSA-2018:1328https://access.redhat.com/errata/RHSA-2018:1525https://access.redhat.com/errata/RHSA-2018:1972https://github.com/paramiko/paramiko/blob/master/sites/www/changelog.rsthttps://github.com/paramiko/paramiko/commit/fa29bd8446c8eab237f5187d28787727b4610516https://github.com/paramiko/paramiko/issues/1175https://lists.debian.org/debian-lts-announce/2018/10/msg00018.htmlhttps://lists.debian.org/debian-lts-announce/2021/12/msg00025.htmlhttps://usn.ubuntu.com/3603-1/https://usn.ubuntu.com/3603-2/https://www.exploit-db.com/exploits/45712/
2018-03-13
Published