9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
paramiko is vulnerable to authentication bypass attacks. The vulnerability exists as the SSH server implementation of paramiko processes requests without waiting for the completion of authentication. This allows attackers to use a customized SSH client that skips authentication and continue its unauthenticated session.
www.securityfocus.com/bid/103713
access.redhat.com/errata/RHSA-2018:0591
access.redhat.com/errata/RHSA-2018:0646
access.redhat.com/errata/RHSA-2018:1124
access.redhat.com/errata/RHSA-2018:1125
access.redhat.com/errata/RHSA-2018:1213
access.redhat.com/errata/RHSA-2018:1274
access.redhat.com/errata/RHSA-2018:1328
access.redhat.com/errata/RHSA-2018:1525
access.redhat.com/errata/RHSA-2018:1972
access.redhat.com/security/updates/classification/#low
github.com/paramiko/paramiko/blob/master/sites/www/changelog.rst
github.com/paramiko/paramiko/commit/fa29bd8446c8eab237f5187d28787727b4610516
github.com/paramiko/paramiko/issues/1175
lists.debian.org/debian-lts-announce/2018/10/msg00018.html
lists.debian.org/debian-lts-announce/2021/12/msg00025.html
usn.ubuntu.com/3603-1/
usn.ubuntu.com/3603-2/
www.exploit-db.com/exploits/45712/
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P