CVE-2018-1000805

Aliases:GHSA-f2j6-wrhh-v25mPYSEC-2018-69
Advisory lineage Upstream: 0 Downstream: 17
Modified
Published: 08 Oct 2018, 15:00
Last modified:05 Aug 2024, 12:40

Vulnerability Summary

Overall Risk (default)
medium
35/100
CVSS Score
8.8 HIGH
v3.1 (nvd)
EPSS Score
0.91% LOW
1% probability +0.52%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

08 Oct 2018, 15:00
Published
Vulnerability first disclosed
05 Aug 2024, 12:40
Last Modified
Vulnerability information updated

Description

Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.

CVSS Metrics

  • v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • v3.1•HIGH•Score: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • v3.0•HIGH•Score: 8.8CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • v2.0•MEDIUM•Score: 6.5AV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 0.91%• Percentile: 76%

Techniques & Countermeasures

  • CWE-863•Incorrect Authorization

    The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Affected Systems

  • canonical•ubuntu_linux

    12.04 | 14.04 | 16.04 | 18.04 | 18.10

  • debian•debian_linux

    8.0 | 9.0

  • paramiko•paramiko

    1.17.6 | 1.18.5 | 2.0.8 | 2.1.5 | 2.2.3 | 2.3.2 | 2.4.1

  • PyPI•paramiko

    ≥ 2.4.0, < 2.4.2 | ≥ 2.3.0, < 2.3.3 | ≥ 2.2.0, < 2.2.4 | ≥ 2.1.0, < 2.1.6 | ≥ 1.5.1, < 2.0.9

  • redhat•ansible_tower

    3.3

  • redhat•enterprise_linux_desktop

    6.0 | 7.0

  • redhat•enterprise_linux_server

    6.0 | 7.0

  • redhat•enterprise_linux_server_aus

    6.4 | 6.5 | 6.6 | 7.6

  • redhat•enterprise_linux_server_eus

    6.7 | 7.6

  • redhat•enterprise_linux_server_tus

    6.6 | 7.6

  • redhat•enterprise_linux_workstation

    6.0 | 7.0

  • redhat•virtualization_host

    4.0

References (18)