CVE-2018-7750

critical · 9.8

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.

9.8

CVSS

27.1%

EPSS (exploit prob.)

98th

EPSS percentile

2018-03-13

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-287

Affected products

Vendor	Product	Affected versions
paramiko	paramiko	< 1.17.6
paramiko	paramiko	>= 1.18.0, < 1.18.5
paramiko	paramiko	>= 2.0.0, < 2.0.8
paramiko	paramiko	>= 2.1.0, < 2.1.5
paramiko	paramiko	>= 2.2.0, < 2.2.3
paramiko	paramiko	>= 2.3.0, < 2.3.2
paramiko	paramiko	2.4.0
redhat	ansible_engine	2.0
redhat	ansible_engine	2.4
redhat	cloudforms	4.5
redhat	cloudforms	4.6
redhat	virtualization	4.1
redhat	enterprise_linux_desktop	6.0
redhat	enterprise_linux_server	6.0
redhat	enterprise_linux_server	7.0
redhat	enterprise_linux_server_aus	6.4
redhat	enterprise_linux_server_aus	6.5
redhat	enterprise_linux_server_aus	6.6
redhat	enterprise_linux_server_eus	6.7
redhat	enterprise_linux_server_tus	6.6
redhat	enterprise_linux_workstation	6.0
debian	debian_linux	8.0
debian	debian_linux	9.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-7750