CVE-2018-1000805: canonical ubuntu_linux Incorrect Authorization
Vulnerability summary
CVE-2018-1000805 is a high (CVSS 8.8) Incorrect Authorization vulnerability in canonical ubuntu_linux. EPSS estimates a 4.41% chance of exploitation in the next 30 days, higher than 91.3% of scored vulnerabilities.
Not severe (CVSS 8.8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 2Timeline
- 08-10-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.
CVSS metrics
9 scores · 6 sources · 4 versions- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
4.41%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.41% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse31 products
- python-amqp&distro=SUSE OpenStack Cloud 7< 1.4.9-3.3.1
- python-oslo.messaging&distro=SUSE OpenStack Cloud 7< 5.10.2-3.9.1
- python-ovs&distro=SUSE OpenStack Cloud 7< 2.5.0-3.3.1
- python-paramiko&distro=HPE Helion OpenStack 8< 2.2.4-4.3.1
- python-paramiko&distro=SUSE Enterprise Storage 4< 2.0.9-3.6.1
Redhat11 products
- ansible_tower3.3
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_aus6.4 | 6.5 | 6.6 | 7.6
- enterprise_linux_server_eus6.7 | 7.6
Alpine2 products
- py-paramiko< 2.1.6-r0 | < 2.4.2-r0
- py3-paramiko< 2.4.2-r0
Debian2 products
- paramiko< 2.4.2-0.1
- debian_linuxEOL8.0 | 9.0
Opensuse2 products
- python-paramiko&distro=openSUSE Leap 15.3< 2.4.3-150100.6.15.1
- python-paramiko&distro=openSUSE Leap 15.4< 2.4.3-150100.6.15.1
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 18.10
Paramiko1 product
- paramiko1.17.6 | 1.18.5 | 2.0.8 | 2.1.5 | 2.2.3 | 2.3.2 | 2.4.1
PyPI1 product
- paramiko≥ 2.4.0, < 2.4.2 | ≥ 2.3.0, < 2.3.3 | ≥ 2.2.0, < 2.2.4 | ≥ 2.1.0, < 2.1.6 | ≥ 1.5.1, < 2.0.9
Ubuntu1 product
- paramiko< 1.10.1-1git1ubuntu0.2 | < 1.16.0-1ubuntu0.2 | < 2.0.0-1ubuntu1.1
9 vendors · 52 products
References
49 links- access.redhat.com/errata/RHSA-2018:3347Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEBAdvisory
- access.redhat.com/errata/RHSA-2018:3406Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEBAdvisory
- access.redhat.com/errata/RHSA-2018:3505Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEBAdvisory
lists.debian.org/debian-lts-announce/2018/10/msg00018.htmlMailing ListX Refsource MLISTThird Party AdvisoryWEB- access.redhat.com/errata/RHBA-2018:3497Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEBAdvisory
Show all 49 references
- lists.debian.org/debian-lts-announce/2021/12/msg00025.htmlMailing ListX Refsource MLISTThird Party AdvisoryWEB
- github.com/paramiko/paramikoPACKAGE