CVE-2018-7750

CRITICAL9.8EPSS 13.8%

Paramiko not properly checking authentication before processing other requests

Published: 7/12/2018Modified: 4/28/2026

Description

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.

Affected packages (4)

Alpine/py3-paramikofrom 0, < 2.4.1-r0
Debian/paramikofrom 0, < 2.4.2-0.1
PyPI/paramiko>= 2.0.0, < 2.0.8
PyPI/paramikofrom 0, < fa29bd8446c8eab237f5187d28787727b4610516 | from 0, < 1.17.6, >= 2.0.0, < 2.0.8, >= 2.1.0, < 2.1.5, >= 2.2.0, < 2.2.3, >= 2.3.0, < 2.3.2, >= 1.18.0, < 1.18.5

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Affected packages (4)

CVSS scores

References (30)