View all vulnerabilities

CVE-2018-7750

Paramiko not properly checking authentication before processing other requests

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading
Vulnerability Details
Score
9.8
Score Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
paramiko >= 2.0.0 < 2.0.8; paramiko >= 2.1.0 < 2.1.5; paramiko >= 2.2.0 < 2.2.3; paramiko >= 2.3.0 < 2.3.2; paramiko >= 2.4.0 < 2.4.1; paramiko >= 1.18.0 < 1.18.5; paramiko < 1.17.6
Severity
Ecosystem
Python
Publish Date
July 12, 2018
Modified Date
October 9, 2024