NetSight
IP …
high8.8

CVE-2018-1000805

Paramiko Authentication Bypass vulnerability

Impact

Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.

Affected packages

EcosystemPackageAffectedFixed in
pipparamiko>= 2.4.0, < 2.4.22.4.2

Affected products

VendorProductAffected versions
ParamikoParamiko
Versions 1.17.6, 1.18.5, 2.0.8, 2.1.5, 2.2.3, 2.3.2
RedhatAnsible Tower
Version 3.3
RedhatVirtualization Host
Version 4.0
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 6.4, 6.5, 6.6, 7.6
RedhatEnterprise Linux Server Eus
Versions 6.7, 7.6
RedhatEnterprise Linux Server Tus
Versions 6.6, 7.6
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0
DebianDebian Linux
Versions 8.0, 9.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 18.04, 18.10

Weakness classification

CWE-863CWE-732

References