CVE-2018-1000805 Paramiko Authentication Bypass vulnerability
An incorrect access control flaw in Paramiko's SSH server allows remote attackers to execute arbitrary code via network connectivity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000805?
CVE-2018-1000805 is a high-severity authentication bypass vulnerability in Canonical Ubuntu Linux, published on 8 Oct 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.
Weakness: CWE-863
Which versions are affected by CVE-2018-1000805?
11 open source packages ship an affected version, including paramiko. It affects 11 products.
| Package | Affected | Fixed in |
|---|---|---|
paramiko PyPI | From 1.5.1 | 2.0.9 |
paramiko PyPI | From 1.5.1 | 2.0.9 |
paramiko PyPI | From 1.5.1 | 2.0.9 |
paramiko PyPI | From 2.1.0 | 2.1.6 |
paramiko PyPI | From 2.1.0 | 2.1.6 |
paramiko PyPI | From 2.2.0 | 2.2.4 |
5 more packages
paramiko PyPI | From 2.2.0 | 2.2.4 |
paramiko PyPI | From 2.3.0 | 2.3.3 |
paramiko PyPI | From 2.3.0 | 2.3.3 |
paramiko PyPI | From 2.4.0 | 2.4.2 |
paramiko PyPI | From 2.4.0 | 2.4.2 |
Linux distribution packages (29)
python-paramiko Red Hat:enterprise_linux:6::client | All versions | 0:1.7.5-5.el6_10 |
python-paramiko Red Hat:enterprise_linux:6::computenode | All versions | 0:1.7.5-5.el6_10 |
python-paramiko Red Hat:enterprise_linux:6::server | All versions | 0:1.7.5-5.el6_10 |
python-paramiko Red Hat:enterprise_linux:6::workstation | All versions | 0:1.7.5-5.el6_10 |
python-paramiko Red Hat:enterprise_linux:7::client | All versions | 0:2.1.1-9.el7 |
python-paramiko-doc Red Hat:enterprise_linux:7::client | All versions | 0:2.1.1-9.el7 |
python-paramiko Red Hat:enterprise_linux:7::computenode | All versions | 0:2.1.1-9.el7 |
python-paramiko-doc Red Hat:enterprise_linux:7::computenode | All versions | 0:2.1.1-9.el7 |
rhvm-appliance Red Hat:enterprise_linux:7::hypervisor | All versions | 2:4.2-20181026.1.el7 |
python-paramiko Red Hat:enterprise_linux:7::server | All versions | 0:2.1.1-9.el7 |
python-paramiko-doc Red Hat:enterprise_linux:7::server | All versions | 0:2.1.1-9.el7 |
python-paramiko Red Hat:enterprise_linux:7::workstation | All versions | 0:2.1.1-9.el7 |
python-paramiko-doc Red Hat:enterprise_linux:7::workstation | All versions | 0:2.1.1-9.el7 |
python-paramiko Red Hat:rhel_aus:6.4::server | All versions | 0:1.7.5-4.el6_4.1 |
python-paramiko Red Hat:rhel_aus:6.5::server | All versions | 0:1.7.5-4.el6_5.1 |
python-paramiko Red Hat:rhel_aus:6.6::server | All versions | 0:1.7.5-4.el6_6.1 |
python-paramiko Red Hat:rhel_eus:6.7::computenode | All versions | 0:1.7.5-4.el6_7.1 |
python-paramiko Red Hat:rhel_eus:6.7::server | All versions | 0:1.7.5-4.el6_7.1 |
python-paramiko Red Hat:rhel_tus:6.6::server | All versions | 0:1.7.5-4.el6_6.1 |
python-paramiko SUSE:Enterprise Storage 4 | All versions | 2.0.9-3.6.1 |
python-paramiko SUSE:Enterprise Storage 5 | All versions | 2.0.9-3.6.1 |
python-paramiko SUSE:Enterprise Storage 6 | All versions | 2.4.3-150100.6.15.1 |
python-paramiko SUSE:Enterprise Storage 7 | All versions | 2.4.3-150100.6.15.1 |
python-paramiko SUSE:HPE Helion OpenStack 8 | All versions | 2.2.4-4.3.1 |
python-paramiko SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | All versions | 2.4.3-150100.6.15.1 |
python-paramiko SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 2.4.3-150100.6.15.1 |
python-paramiko SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | All versions | 2.4.3-150100.6.15.1 |
python-paramiko SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 2.4.3-150100.6.15.1 |
python-paramiko SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 2.4.2-3.3.2 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Paramiko Paramiko, Redhat Ansible Tower, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server and 5 more.
How do I fix CVE-2018-1000805?
Upgrade paramiko to a fixed version for your release line: 2.0.9, 2.1.6, 2.2.4 or 2.3.3.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-1000805 being exploited?
There is no known exploitation of CVE-2018-1000805 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2018-1000805, DEBIAN-CVE-2018-1000805, GHSA-f2j6-wrhh-v25m, OESA-2021-1069, PYSEC-2018-69, RHBA-2018:3497 and 11 more.