CVE-2018-1000805: Paramiko SSH Server Incorrect Access Control Vulnerability
Summary
CVE-2018-1000805: Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. Affects paramiko versions >= 1.5.1, < 2.0.9. Fixed in 2.0.9. How to fix ↓
Also tracked for
- py3-paramiko · Alpine:v3.11
The same CVE-2018-1000805 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Paramiko is a Python implementation of the SSHv2 protocol, providing both client and server functionality. It is widely used for secure remote connections and file transfers. The vulnerability in Paramiko versions 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, and 1.17.6 allows for incorrect access control in the SSH server component. This vulnerability can be exploited remotely over a network connection.
Vulnerability Detail
The incorrect access control vulnerability in Paramiko's SSH server component can lead to remote code execution (RCE) attacks. Attackers can exploit this vulnerability by leveraging network connectivity to bypass access controls and execute arbitrary code on the target system. This can result in unauthorized access, data breaches, and potential compromise of the entire system.
How To Fix
Minimum fixed version
2.0.9
This is the first release that contains the fix.
pip install --upgrade "paramiko==2.0.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if upgrading Paramiko is not immediately feasible, it is recommended to implement additional network security measures such as firewall rules and network segmentation to limit access to the vulnerable SSH server.
Conclusion
The Paramiko SSH server incorrect access control vulnerability (CVE-2018-1000805) poses a significant risk to systems using affected versions of Paramiko. It is crucial to promptly upgrade to a patched version or implement appropriate workarounds to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for paramiko →
FAQ
Paramiko is a Python implementation of the SSHv2 protocol, providing secure remote connections and file transfers.
Paramiko versions 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, and 1.17.6 are affected by this vulnerability.
This vulnerability can be exploited remotely over a network connection to bypass access controls and execute arbitrary code on the target system.
The potential consequences include unauthorized access, data breaches, and potential compromise of the entire system.
To fix this vulnerability, upgrade Paramiko to version 2.0.9 or later.
Related vulnerabilities
Recent vulnerabilities recorded for paramiko.
