ID CVE-2018-7750
Summary transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
References
Vulnerable Configurations
  • cpe:2.3:a:paramiko:paramiko:2.4.0
    cpe:2.3:a:paramiko:paramiko:2.4.0
  • Red Hat Ansible Engine 2.0
    cpe:2.3:a:redhat:ansible_engine:2.0
  • Red Hat Ansible Engine 2.4
    cpe:2.3:a:redhat:ansible_engine:2.4
  • Red Hat CloudForms 4.5
    cpe:2.3:a:redhat:cloudforms:4.5
  • Red Hat CloudForms 4.6
    cpe:2.3:a:redhat:cloudforms:4.6
  • Debian Linux 8.0 (Jessie)
    cpe:2.3:o:debian:debian_linux:8.0
  • Red Hat Enterprise Linux Desktop 6.0
    cpe:2.3:o:redhat:enterprise_linux_desktop:6.0
  • Red Hat Enterprise Linux Server 6.0
    cpe:2.3:o:redhat:enterprise_linux_server:6.0
  • RedHat Enterprise Linux Server 7.0
    cpe:2.3:o:redhat:enterprise_linux_server:7.0
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4
    cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4
  • Red Hat Enterprise Linux Server Advanced mission critical Update Support (AUS) 6.5
    cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6
    cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:6.7
    cpe:2.3:o:redhat:enterprise_linux_server_eus:6.7
  • Red Hat Enterprise Linux Server Telecommunications Update Service (TUS) 6.6
    cpe:2.3:o:redhat:enterprise_linux_server_tus:6.6
  • Red Hat Enterprise Linux Workstation 6.0
    cpe:2.3:o:redhat:enterprise_linux_workstation:6.0
  • Red Hat Virtualization 4.0
    cpe:2.3:o:redhat:virtualization:4.0
  • Red Hat Virtualization 4.1
    cpe:2.3:o:redhat:virtualization:4.1
CVSS
Base: 7.5
Impact:
Exploitability:
CWE CWE-287
CAPEC
  • Authentication Abuse
    An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker. This attack may exploit assumptions made by the target's authentication procedures, such as assumptions regarding trust relationships or assumptions regarding the generation of secret values. This attack differs from Authentication Bypass attacks in that Authentication Abuse allows the attacker to be certified as a valid user through illegitimate means, while Authentication Bypass allows the user to access protected material without ever being certified as an authenticated user. This attack does not rely on prior sessions established by successfully authenticating users, as relied upon for the "Exploitation of Session Variables, Resource IDs and other Trusted Credentials" attack patterns.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Utilizing REST's Trust in the System Resource to Register Man in the Middle
    This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to place man in the middle once SSL is terminated. Rest applications premise is that they leverage existing infrastructure to deliver web services functionality. An example of this is a Rest application that uses HTTP Get methods and receives a HTTP response with an XML document. These Rest style web services are deployed on existing infrastructure such as Apache and IIS web servers with no SOAP stack required. Unfortunately from a security standpoint, there frequently is no interoperable identity security mechanism deployed, so Rest developers often fall back to SSL to deliver security. In large data centers, SSL is typically terminated at the edge of the network - at the firewall, load balancer, or router. Once the SSL is terminated the HTTP request is in the clear (unless developers have hashed or encrypted the values, but this is rare). The attacker can utilize a sniffer such as Wireshark to snapshot the credentials, such as username and password that are passed in the clear once SSL is terminated. Once the attacker gathers these credentials, they can submit requests to the web service provider just as authorized user do. There is not typically an authentication on the client side, beyond what is passed in the request itself so once this is compromised, then this is generally sufficient to compromise the service's authentication scheme.
  • Man in the Middle Attack
    This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed on to the other component as if it was never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identify between two components.
exploit-db via4
file exploits/linux/remote/45712.py
id EDB-ID:45712
last seen 2018-11-30
modified 2018-10-29
platform linux
port
published 2018-10-29
reporter Exploit-DB
source https://www.exploit-db.com/download/45712
title Paramiko 2.4.1 - Authentication Bypass
type remote
nessus via4
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-3603-1.NASL
    description Matthijs Kooijman discovered that Paramiko's SSH server implementation did not properly require authentication before processing requests. An unauthenticated remote attacker could possibly use this to execute arbitrary code. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 108514
    published 2018-03-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=108514
    title Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : paramiko vulnerability (USN-3603-1)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20180412_PYTHON_PARAMIKO_ON_SL6_X.NASL
    description Security Fix(es) : - python-paramiko: Authentication bypass in transport.py (CVE-2018-7750)
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 109057
    published 2018-04-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109057
    title Scientific Linux Security Update : python-paramiko on SL6.x (noarch)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-1556.NASL
    description CVE-2018-1000805 Fix to prevent malicious clients to trick the Paramiko server into thinking an unauthenticated client is authenticated. CVE-2018-7750 Fix check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step. For Debian 8 'Jessie', these problems have been fixed in version 1.15.1-1+deb8u1. We recommend that you upgrade your paramiko packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-10-29
    plugin id 118469
    published 2018-10-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=118469
    title Debian DLA-1556-1 : paramiko security update
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1213.NASL
    description An update for python-paramiko is now available for Red Hat Ansible Engine 2.4 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section. The python-paramiko package provides a Python module that implements the SSH2 protocol for encrypted and authenticated connections to remote machines. Unlike SSL, the SSH2 protocol does not require hierarchical certificates signed by a powerful central authority. The protocol also includes the ability to open arbitrary channels to remote services across an encrypted tunnel. Security Fix(es) : * python-paramiko: Authentication bypass in transport.py (CVE-2018-7750) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109387
    published 2018-04-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109387
    title RHEL 7 : python-paramiko (RHSA-2018:1213)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2018-989.NASL
    description Authentication bypass in transport.py transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step. (CVE-2018-7750 )
    last seen 2019-02-21
    modified 2018-08-31
    plugin id 108850
    published 2018-04-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=108850
    title Amazon Linux AMI : python-paramiko (ALAS-2018-989)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2018-305.NASL
    description This update for python-paramiko fixes the following issues : - CVE-2018-7750: Fixed transport.py in the SSH server implementation of Paramiko that does not properly check whether authentication is completed before processing other requests (bsc#1085276).
    last seen 2019-02-21
    modified 2018-09-04
    plugin id 108632
    published 2018-03-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=108632
    title openSUSE Security Update : python-paramiko (openSUSE-2018-305)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1274.NASL
    description An update for python-paramiko is now available for Red Hat Virtualization 4 Management Agent for RHEL 7 and Red Hat Virtualization Manager 4.1. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section. The python-paramiko package provides a Python module that implements the SSH2 protocol for encrypted and authenticated connections to remote machines. Unlike SSL, the SSH2 protocol does not require hierarchical certificates signed by a powerful central authority. The protocol also includes the ability to open arbitrary channels to remote services across an encrypted tunnel. The following packages have been upgraded to a later upstream version: python-paramiko (2.1.1). (BZ#1562393) Security Fix(es) : * python-paramiko: Authentication bypass in transport.py (CVE-2018-7750) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109567
    published 2018-05-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109567
    title RHEL 7 : Virtualization (RHSA-2018:1274)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-0591.NASL
    description An update for python-paramiko is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The python-paramiko package provides a Python module that implements the SSH2 protocol for encrypted and authenticated connections to remote machines. Unlike SSL, the SSH2 protocol does not require hierarchical certificates signed by a powerful central authority. The protocol also includes the ability to open arbitrary channels to remote services across an encrypted tunnel. Security Fix(es) : * python-paramiko: Authentication bypass in transport.py (CVE-2018-7750) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es) : * python-paramiko has been using the python2-pyasn1 package, but did not depend on it. With new versions of python2-cryptography, python2-pyasn1 was not getting installed and this caused python-paramiko to malfunction. This bug was fixed by making python-paramiko depend on python2-pyasn1 explicitly. (BZ#1559133)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 108643
    published 2018-03-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=108643
    title RHEL 7 : python-paramiko (RHSA-2018:0591)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2018-C1769746DA.NASL
    description A flaw was found in the implementation of `transport.py` in Paramiko, which did not properly check whether authentication was completed before processing other requests. A customized SSH client could simply skip the authentication step. This flaw is a user authentication bypass in the SSH Server functionality of Paramiko. Where Paramiko is used only for its client-side functionality (e.g. `paramiko.SSHClient`), the vulnerability is not exposed and thus cannot be exploited. This update also fixes an issue where Ed25519 auth key decryption raised an unexpected exception when given a unicode password string (typical in Python 3). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-09-05
    plugin id 108779
    published 2018-04-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=108779
    title Fedora 26 : python-paramiko (2018-c1769746da)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2018-1124.NASL
    description An update for python-paramiko is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The python-paramiko package provides a Python module that implements the SSH2 protocol for encrypted and authenticated connections to remote machines. Unlike SSL, the SSH2 protocol does not require hierarchical certificates signed by a powerful central authority. The protocol also includes the ability to open arbitrary channels to remote services across an encrypted tunnel. Security Fix(es) : * python-paramiko: Authentication bypass in transport.py (CVE-2018-7750) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109526
    published 2018-05-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109526
    title CentOS 6 : python-paramiko (CESA-2018:1124)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2018-8F9D81A3FB.NASL
    description A flaw was found in the implementation of `transport.py` in Paramiko, which did not properly check whether authentication was completed before processing other requests. A customized SSH client could simply skip the authentication step. This flaw is a user authentication bypass in the SSH Server functionality of Paramiko. Where Paramiko is used only for its client-side functionality (e.g. `paramiko.SSHClient`), the vulnerability is not exposed and thus cannot be exploited. This update also fixes an issue where Ed25519 auth key decryption raised an unexpected exception when given a unicode password string (typical in Python 3). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-01-03
    plugin id 120611
    published 2019-01-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=120611
    title Fedora 28 : python-paramiko (2018-8f9d81a3fb)
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2018-0034.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : - Fix and enable tests (%check). - Backport a change which makes tests exit with nonzero status when they fail. - Add a fix for upstream tests for CVE-2018-7750 (broken in previous). - Fix a security flaw (CVE-2018-7750) in Paramiko's server mode (emphasis on **server** mode this does **not** impact *client* use!) Backported from 1.10: Resolves #1557140
    last seen 2019-02-21
    modified 2018-09-05
    plugin id 109157
    published 2018-04-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109157
    title OracleVM 3.3 / 3.4 : python-paramiko (OVMSA-2018-0034)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2018-1124.NASL
    description From Red Hat Security Advisory 2018:1124 : An update for python-paramiko is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The python-paramiko package provides a Python module that implements the SSH2 protocol for encrypted and authenticated connections to remote machines. Unlike SSL, the SSH2 protocol does not require hierarchical certificates signed by a powerful central authority. The protocol also includes the ability to open arbitrary channels to remote services across an encrypted tunnel. Security Fix(es) : * python-paramiko: Authentication bypass in transport.py (CVE-2018-7750) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
    last seen 2019-02-21
    modified 2018-09-05
    plugin id 109025
    published 2018-04-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109025
    title Oracle Linux 6 : python-paramiko (ELSA-2018-1124)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1124.NASL
    description An update for python-paramiko is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The python-paramiko package provides a Python module that implements the SSH2 protocol for encrypted and authenticated connections to remote machines. Unlike SSL, the SSH2 protocol does not require hierarchical certificates signed by a powerful central authority. The protocol also includes the ability to open arbitrary channels to remote services across an encrypted tunnel. Security Fix(es) : * python-paramiko: Authentication bypass in transport.py (CVE-2018-7750) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109026
    published 2018-04-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109026
    title RHEL 6 : python-paramiko (RHSA-2018:1124)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1125.NASL
    description An update for python-paramiko is now available for Red Hat Enterprise Linux 6.4 Advanced Update Support, Red Hat Enterprise Linux 6.5 Advanced Update Support, Red Hat Enterprise Linux 6.6 Advanced Update Support, Red Hat Enterprise Linux 6.6 Telco Extended Update Support, and Red Hat Enterprise Linux 6.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The python-paramiko package provides a Python module that implements the SSH2 protocol for encrypted and authenticated connections to remote machines. Unlike SSL, the SSH2 protocol does not require hierarchical certificates signed by a powerful central authority. The protocol also includes the ability to open arbitrary channels to remote services across an encrypted tunnel. Security Fix(es) : * python-paramiko: Authentication bypass in transport.py (CVE-2018-7750) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109027
    published 2018-04-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109027
    title RHEL 6 : python-paramiko (RHSA-2018:1125)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-0646.NASL
    description An update for python-paramiko is now available for Red Hat Ansible Engine 2 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section. The python-paramiko package provides a Python module that implements the SSH2 protocol for encrypted and authenticated connections to remote machines. Unlike SSL, the SSH2 protocol does not require hierarchical certificates signed by a powerful central authority. The protocol also includes the ability to open arbitrary channels to remote services across an encrypted tunnel. Security Fix(es) : * python-paramiko: Authentication bypass in transport.py (CVE-2018-7750) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 108982
    published 2018-04-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=108982
    title RHEL 7 : python-paramiko (RHSA-2018:0646)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1525.NASL
    description An update for rhvm-appliance is now available for Red Hat Virtualization 4 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization Manager. The appliance is available to download as an OVA file from the Customer Portal. The following packages have been upgraded to a later upstream version: rhvm-appliance (4.2). (BZ#1558801, BZ#1563545) Security Fix(es) : * python-paramiko: Authentication bypass in transport.py (CVE-2018-7750) * slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution (CVE-2018-8088) * undertow: Client can use bogus uri in Digest authentication (CVE-2017-12196) * jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485) (CVE-2018-5968) * ovirt-engine: account enumeration through login to web console (CVE-2018-1073) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Chris McCown for reporting CVE-2018-8088. The CVE-2017-12196 issue was discovered by Jan Stourac (Red Hat). Enhancement(s) : * Previously, the default memory allotment for the RHV-M Virtual Appliance was always large enough to include support for user additions. In this release, the RHV-M Virtual Appliance includes a swap partition that enables the memory to be increased when required. (BZ#1422982) * Previously, the partitioning scheme for the RHV-M Virtual Appliance included two primary partitions, '/' and swap. In this release, the disk partitioning scheme has been modified to match the scheme specified by NIST. The updated disk partitions are as follows : /boot 1G (primary) /home 1G (lvm) /tmp 2G (lvm) /var 20G (lvm) /var/log 10G (lvm) /var/log/audit 1G (lvm) swap 8G (lvm) / 6G (primary) (BZ#1463853) * Previously, the version tag was used as part of the RPM's naming scheme, for example, '4.1.timestamp', which created differences between the upstream and downstream versioning schemes. In this release, the downstream versioning scheme is aligned with the upstream scheme and the timestamp has moved from the version tag to the release tag. (BZ#1464486)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109910
    published 2018-05-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109910
    title RHEL 7 : Virtualization (RHSA-2018:1525)
  • NASL family PhotonOS Local Security Checks
    NASL id PHOTONOS_PHSA-2018-2_0-0037.NASL
    description An update of {'mercurial', 'python2', 'zsh', 'pycrypto', 'patch', 'binutils', 'paramiko', 'httpd', 'mysql', 'xerces-c', 'util-linux', 'net-snmp', 'python3', 'sqlite'} packages of Photon OS has been released.
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 111297
    published 2018-07-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=111297
    title Photon OS 2.0 : Zsh / Python3 / Xerces / Mercurial / Pmd / Pycrypto / Net / Python2 / Util / Mysql / Paramiko / Binutils / Patch / Sqlite (PhotonOS-PHSA-2018-2.0-0037) (deprecated)
  • NASL family PhotonOS Local Security Checks
    NASL id PHOTONOS_PHSA-2018-1_0-0126.NASL
    description An update of 'paramiko', 'mysql', 'mercurial', 'binutils', 'pycrypto', 'patch', 'sqlite-autoconf', 'httpd', 'python3', 'xerces-c', 'strongswan', 'net-snmp' packages of Photon OS has been released.
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 111930
    published 2018-08-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=111930
    title Photon OS 1.0: Binutils / Httpd / Mercurial / Mysql / Net / Paramiko / Patch / Pycrypto / Python3 / Sqlite / Strongswan / Xerces PHSA-2018-1.0-0126 (deprecated)
packetstorm via4
redhat via4
advisories
  • bugzilla
    id 1557130
    title CVE-2018-7750 python-paramiko: Authentication bypass in transport.py
    oval
    AND
    • comment python-paramiko is earlier than 0:1.7.5-4.el6_9
      oval oval:com.redhat.rhsa:tst:20181124005
    • comment python-paramiko is signed with Red Hat redhatrelease2 key
      oval oval:com.redhat.rhsa:tst:20181124006
    • OR
      • comment Red Hat Enterprise Linux 6 Client is installed
        oval oval:com.redhat.rhsa:tst:20100842001
      • comment Red Hat Enterprise Linux 6 Server is installed
        oval oval:com.redhat.rhsa:tst:20100842002
      • comment Red Hat Enterprise Linux 6 Workstation is installed
        oval oval:com.redhat.rhsa:tst:20100842003
      • comment Red Hat Enterprise Linux 6 ComputeNode is installed
        oval oval:com.redhat.rhsa:tst:20100842004
    rhsa
    id RHSA-2018:1124
    released 2018-04-12
    severity Critical
    title RHSA-2018:1124: python-paramiko security update (Critical)
  • rhsa
    id RHSA-2018:0591
  • rhsa
    id RHSA-2018:0646
  • rhsa
    id RHSA-2018:1125
  • rhsa
    id RHSA-2018:1213
  • rhsa
    id RHSA-2018:1274
  • rhsa
    id RHSA-2018:1328
  • rhsa
    id RHSA-2018:1525
  • rhsa
    id RHSA-2018:1972
rpms python-paramiko-0:1.7.5-4.el6_9
refmap via4
bid 103713
confirm
exploit-db 45712
mlist [debian-lts-announce] 20181027 [SECURITY] [DLA 1556-1] paramiko security update
ubuntu
  • USN-3603-1
  • USN-3603-2
Last major update 13-03-2018 - 14:29
Published 13-03-2018 - 14:29
Last modified 28-02-2019 - 14:20
Back to Top