GitHub Advisoryadvisory · PyPI

GHSA-f2j6-wrhh-v25m Paramiko Authentication Bypass vulnerability

HIGH Published 2018-10-10 Modified 2024-10-09 Official page ↗
Aliases
CVE-2018-1000805
Ecosystem
PyPI
Packages
paramiko
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-732, CWE-863
Reviewed
2020-06-16

Affected packages

• PyPI paramiko: >= 2.4.0, < 2.4.2 → fixed in 2.4.2 • PyPI paramiko: >= 2.3.0, < 2.3.3 → fixed in 2.3.3 • PyPI paramiko: >= 2.2.0, < 2.2.4 → fixed in 2.2.4 • PyPI paramiko: >= 2.1.0, < 2.1.6 → fixed in 2.1.6 • PyPI paramiko: >= 1.5.1, < 2.0.9 → fixed in 2.0.9

Description

Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.

Related

Alias · CVE (1)

  • CVE-2018-1000805 Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can… vulnerability

Weakness · CWE (2)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness
  • CWE-863 Incorrect Authorization weakness

References