CVE-2018-7750
A flaw was found in the implementation of transport.py in Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step. Upstream Issue: https://github.com/paramiko/paramiko/issues/1175 Upstream Patch: https://github.com/paramiko/paramiko/commit/fa29bd8446c8eab237f5187d28787727b4610516
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this security issue?
The vulnerability ID of this security issue is CVE-2018-7750.
What is the severity of CVE-2018-7750?
The severity of CVE-2018-7750 is critical with a severity value of 9.8.
What software versions are affected by CVE-2018-7750?
The software versions affected by CVE-2018-7750 are Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1.
How can I fix CVE-2018-7750?
To fix CVE-2018-7750, update Paramiko to version 1.17.6 or higher, 1.18.5 or higher, 2.0.8 or higher, 2.1.5 or higher, 2.2.3 or higher, 2.3.2 or higher, or 2.4.1 or higher.
Where can I find more information about CVE-2018-7750?
You can find more information about CVE-2018-7750 in the following references: [link1], [link2], [link3].