CVE-2018-7750

CRITICAL9.8EPSS 13.8%

Paramiko not properly checking authentication before processing other requests

發布日:2018/7/12修改日:2026/4/28

描述

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.

受影響套件(4)

Alpine/py3-paramikofrom 0, < 2.4.1-r0
Debian/paramikofrom 0, < 2.4.2-0.1
PyPI/paramiko>= 2.0.0, < 2.0.8
PyPI/paramikofrom 0, < fa29bd8446c8eab237f5187d28787727b4610516 | from 0, < 1.17.6, >= 2.0.0, < 2.0.8, >= 2.1.0, < 2.1.5, >= 2.2.0, < 2.2.3, >= 2.3.0, < 2.3.2, >= 1.18.0, < 1.18.5

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

描述

受影響套件(4)

CVSS 分數

參考連結(30)