CVE-2018-7750 Paramiko not properly checking authentication before processing other requests
Attackers can bypass SSH authentication in Paramiko by skipping the auth step, allowing unauthorized access to the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-7750?
CVE-2018-7750 is a critical authentication bypass vulnerability in Debian Debian Linux, published on 13 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
Weakness: CWE-287
Which versions are affected by CVE-2018-7750?
15 open source packages ship an affected version, including paramiko. It affects 11 products.
| Package | Affected | Fixed in |
|---|---|---|
paramiko PyPI | All versions | 1.17.6, 1.18.5, 2.0.8, 2.1.5, 2.2.3, 2.3.2 |
paramiko PyPI | All versions | 1.17.6 |
paramiko PyPI | All versions | 1.17.6 |
paramiko PyPI | From 1.18.0 | 1.18.5 |
paramiko PyPI | From 1.18.0 | 1.18.5 |
paramiko PyPI | From 2.0.0 | 2.0.8 |
9 more packages
paramiko PyPI | From 2.0.0 | 2.0.8 |
paramiko PyPI | From 2.1.0 | 2.1.5 |
paramiko PyPI | From 2.1.0 | 2.1.5 |
paramiko PyPI | From 2.2.0 | 2.2.3 |
paramiko PyPI | From 2.2.0 | 2.2.3 |
paramiko PyPI | From 2.3.0 | 2.3.2 |
paramiko PyPI | From 2.3.0 | 2.3.2 |
paramiko PyPI | From 2.4.0 | 2.4.1 |
paramiko PyPI | From 2.4.0 | 2.4.1 |
Linux distribution packages (25)
python-paramiko Red Hat:ansible_engine:2.4::el7 | All versions | 0:2.1.1-4.el7 |
python-paramiko Red Hat:ansible_engine:2::el7 | All versions | 0:2.1.1-4.el7 |
python-paramiko Red Hat:enterprise_linux:6::client | All versions | 0:1.7.5-4.el6_9 |
python-paramiko Red Hat:enterprise_linux:6::computenode | All versions | 0:1.7.5-4.el6_9 |
python-paramiko Red Hat:enterprise_linux:6::server | All versions | 0:1.7.5-4.el6_9 |
python-paramiko Red Hat:enterprise_linux:6::workstation | All versions | 0:1.7.5-4.el6_9 |
python-paramiko Red Hat:enterprise_linux:7::hypervisor | All versions | 0:2.1.1-4.el7 |
python-paramiko-doc Red Hat:enterprise_linux:7::hypervisor | All versions | 0:2.1.1-4.el7 |
python-paramiko Red Hat:rhel_aus:6.4::server | All versions | 0:1.7.5-4.el6_4 |
python-paramiko Red Hat:rhel_aus:6.5::server | All versions | 0:1.7.5-4.el6_5 |
python-paramiko Red Hat:rhel_aus:6.6::server | All versions | 0:1.7.5-4.el6_6 |
python-paramiko Red Hat:rhel_eus:6.7::computenode | All versions | 0:1.7.5-4.el6_7 |
python-paramiko Red Hat:rhel_eus:6.7::server | All versions | 0:1.7.5-4.el6_7 |
python-paramiko Red Hat:rhel_extras_other:7 | All versions | 0:2.1.1-4.el7 |
python-paramiko-doc Red Hat:rhel_extras_other:7 | All versions | 0:2.1.1-4.el7 |
python-paramiko Red Hat:rhel_tus:6.6::server | All versions | 0:1.7.5-4.el6_6 |
python-paramiko Red Hat:rhev_manager:4 | All versions | 0:2.1.1-4.el7 |
python-paramiko-doc Red Hat:rhev_manager:4 | All versions | 0:2.1.1-4.el7 |
python-paramiko SUSE:Enterprise Storage 3 | All versions | 1.15.2-2.6.1 |
python-paramiko SUSE:Enterprise Storage 4 | All versions | 2.0.8-3.3.1 |
python-paramiko SUSE:Enterprise Storage 5 | All versions | 2.0.8-3.3.1 |
python-paramiko SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 1.15.2-2.9.1 |
python-paramiko SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 1.18.5-2.12.1 |
python-paramiko SUSE:OpenStack Cloud 6 | All versions | 1.15.2-2.6.1 |
python-paramiko SUSE:OpenStack Cloud 7 | All versions | 2.0.8-3.3.1 |
Products include Debian Debian Linux, Paramiko Paramiko, Redhat Ansible Engine, Redhat Cloudforms, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server and 5 more.
How do I fix CVE-2018-7750?
Upgrade paramiko to a fixed version for your release line: 1.17.6, 1.18.5, 2.0.8 or 2.1.5.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-7750 being exploited?
There is no known exploitation of CVE-2018-7750 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 2 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2018-7750, DEBIAN-CVE-2018-7750, GHSA-232r-66cg-79px, MGASA-2018-0204, PYSEC-2018-19, RHSA-2018:0591 and 12 more.