CVE-2018-7750

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2018-7750

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-7750.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-7750

Aliases

Related

Published

2018-03-13T18:29:00Z

Modified

2024-10-12T04:08:18.697153Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.

References

Affected packages

Alpine:v3.11 / py3-paramiko

Package

Name: py3-paramiko
Purl: pkg:apk/alpine/py3-paramiko?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.1-r0

Affected versions

1.*

1.7.7.1-r0

1.9.0-r0

1.10.1-r0

1.11.0-r0

1.12.0-r0

1.14.0-r0

1.14.1-r0

1.15.1-r0

1.15.2-r0

1.16.0-r0

2.*

2.0.1-r1

2.0.1-r2

2.0.2-r0

2.0.2-r1

2.0.2-r2

2.0.2-r3

2.1.2-r0

2.2.0-r0

2.2.1-r0

2.2.1-r1

2.3.1-r0

2.4.0-r0

Alpine:v3.12 / py3-paramiko

Package

Name: py3-paramiko
Purl: pkg:apk/alpine/py3-paramiko?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.1-r0

Affected versions

1.*

1.7.7.1-r0

1.9.0-r0

1.10.1-r0

1.11.0-r0

1.12.0-r0

1.14.0-r0

1.14.1-r0

1.15.1-r0

1.15.2-r0

1.16.0-r0

2.*

2.0.1-r1

2.0.1-r2

2.0.2-r0

2.0.2-r1

2.0.2-r2

2.0.2-r3

2.1.2-r0

2.2.0-r0

2.2.1-r0

2.2.1-r1

2.3.1-r0

2.4.0-r0

Alpine:v3.13 / py3-paramiko

Package

Name: py3-paramiko
Purl: pkg:apk/alpine/py3-paramiko?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.1-r0

Affected versions

1.*

1.7.7.1-r0

1.9.0-r0

1.10.1-r0

1.11.0-r0

1.12.0-r0

1.14.0-r0

1.14.1-r0

1.15.1-r0

1.15.2-r0

1.16.0-r0

2.*

2.0.1-r1

2.0.1-r2

2.0.2-r0

2.0.2-r1

2.0.2-r2

2.0.2-r3

2.1.2-r0

2.2.0-r0

2.2.1-r0

2.2.1-r1

2.3.1-r0

2.4.0-r0

Alpine:v3.14 / py3-paramiko

Package

Name: py3-paramiko
Purl: pkg:apk/alpine/py3-paramiko?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.1-r0

Affected versions

1.*

1.7.7.1-r0

1.9.0-r0

1.10.1-r0

1.11.0-r0

1.12.0-r0

1.14.0-r0

1.14.1-r0

1.15.1-r0

1.15.2-r0

1.16.0-r0

2.*

2.0.1-r1

2.0.1-r2

2.0.2-r0

2.0.2-r1

2.0.2-r2

2.0.2-r3

2.1.2-r0

2.2.0-r0

2.2.1-r0

2.2.1-r1

2.3.1-r0

2.4.0-r0

Debian:11 / paramiko

Package

Name: paramiko
Purl: pkg:deb/debian/paramiko?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-0.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / paramiko

Package

Name: paramiko
Purl: pkg:deb/debian/paramiko?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-0.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / paramiko

Package

Name: paramiko
Purl: pkg:deb/debian/paramiko?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-0.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/ansible/ansible

Affected ranges

Type: GIT
Repo: https://github.com/ansible/ansible
Events: Introduced

b599477242c44365236d4bae3e7766e37e6c4633

Fixed

39ce8c6610ecaa1a5f992f76d4f868b2cce8fd39

Type: GIT
Repo: https://github.com/paramiko/paramiko
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

fa29bd8446c8eab237f5187d28787727b4610516

Affected versions

1.*

1.10.0

1.10.1

1.10.2

1.10.3

1.10.4

1.10.5

1.10.6

1.10.7

1.11.0

1.11.1

1.11.2

1.11.3

1.11.4

1.11.5

1.11.6

1.12.0

1.12.1

1.12.2

1.12.3

1.12.4

1.13.0

1.13.1

1.13.2

1.13.3

1.13.4

1.14.0

1.14.1

1.14.2

1.14.3

1.15.0

1.15.1

1.15.2

1.15.3

1.15.4

1.15.5

1.16.0

1.16.1

1.16.2

1.16.3

1.17.0

1.17.1

1.17.2

1.17.3

1.18.0

1.18.1

1.7.7.1

1.7.7.2

1.8.0

1.8.1

1.9.0

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

Other

initial-merge-from-ssh-done

py3-test-parity

release-1.*

release-1.7.4

release-1.7.5

release-1.7.6

v1.*

v1.10.0

v1.10.1

v1.10.2

v1.10.3

v1.10.4

v1.10.5

v1.10.6

v1.10.7

v1.11.0

v1.11.1

v1.11.2

v1.11.3

v1.11.4

v1.11.5

v1.11.6

v1.12.0

v1.12.1

v1.12.2

v1.12.3

v1.12.4

v1.13.0

v1.13.1

v1.13.2

v1.13.3

v1.13.4

v1.14.0

v1.14.1

v1.14.2

v1.14.3

v1.15.0

v1.15.1

v1.15.2

v1.15.3

v1.15.4

v1.15.5

v1.16.0

v1.16.1

v1.16.2

v1.16.3

v1.17.0

v1.17.1

v1.17.2

v1.17.3

v1.18.0

v1.18.1

v1.7.7.1

v1.7.7.2

v1.8.0

v1.8.1

v1.9.0