CVE-2018-7750

CRITICAL

9.8

Beschreibung

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht3/13/2018

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

debian:debian_linuxparamiko:paramikoredhat:ansible_engineredhat:cloudformsredhat:enterprise_linux_desktopredhat:enterprise_linux_serverredhat:enterprise_linux_server_ausredhat:enterprise_linux_server_eusredhat:enterprise_linux_server_tusredhat:enterprise_linux_workstationredhat:virtualization

Schwachen (CWE)

CWE-287

Referenzen

http://www.securityfocus.com/bid/103713(cve@mitre.org)

https://access.redhat.com/errata/RHSA-2018:0591(cve@mitre.org)

https://access.redhat.com/errata/RHSA-2018:0646(cve@mitre.org)

https://access.redhat.com/errata/RHSA-2018:1124(cve@mitre.org)

https://access.redhat.com/errata/RHSA-2018:1125(cve@mitre.org)

https://access.redhat.com/errata/RHSA-2018:1213(cve@mitre.org)

https://access.redhat.com/errata/RHSA-2018:1274(cve@mitre.org)

https://access.redhat.com/errata/RHSA-2018:1328(cve@mitre.org)

https://access.redhat.com/errata/RHSA-2018:1525(cve@mitre.org)

https://access.redhat.com/errata/RHSA-2018:1972(cve@mitre.org)

https://github.com/paramiko/paramiko/blob/master/sites/www/changelog.rst(cve@mitre.org)

https://github.com/paramiko/paramiko/commit/fa29bd8446c8eab237f5187d28787727b4610516(cve@mitre.org)

https://github.com/paramiko/paramiko/issues/1175(cve@mitre.org)

https://lists.debian.org/debian-lts-announce/2018/10/msg00018.html(cve@mitre.org)

https://lists.debian.org/debian-lts-announce/2021/12/msg00025.html(cve@mitre.org)

https://usn.ubuntu.com/3603-1/(cve@mitre.org)

https://usn.ubuntu.com/3603-2/(cve@mitre.org)

https://www.exploit-db.com/exploits/45712/(cve@mitre.org)

http://www.securityfocus.com/bid/103713(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2018:0591(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2018:0646(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2018:1124(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2018:1125(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2018:1213(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2018:1274(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2018:1328(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2018:1525(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2018:1972(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/paramiko/paramiko/blob/master/sites/www/changelog.rst(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/paramiko/paramiko/commit/fa29bd8446c8eab237f5187d28787727b4610516(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/paramiko/paramiko/issues/1175(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2018/10/msg00018.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2021/12/msg00025.html(af854a3a-2127-422b-91ae-364da2661108)

https://usn.ubuntu.com/3603-1/(af854a3a-2127-422b-91ae-364da2661108)

https://usn.ubuntu.com/3603-2/(af854a3a-2127-422b-91ae-364da2661108)

https://www.exploit-db.com/exploits/45712/(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.