FEDORA-EPEL-2018-86171fce03 created by pghmcfc 2 years ago for Fedora EPEL 7
stable

A flaw was found in the implementation of transport.py in Paramiko, which did not properly check whether authentication was completed before processing other requests. A customized SSH client could simply skip the authentication step.

This flaw is a user authentication bypass in the SSH Server functionality of Paramiko. Where Paramiko is used only for its client-side functionality (e.g. paramiko.SSHClient), the vulnerability is not exposed and thus cannot be exploited.

This update has been submitted for testing by pghmcfc.

2 years ago

This update has been pushed to testing.

2 years ago

This update has reached 14 days in testing and can be pushed to stable now if the maintainer wishes

2 years ago

This update has been submitted for batched by pghmcfc.

2 years ago

This update has been submitted for stable by bodhi.

2 years ago

This update has been pushed to stable.

2 years ago

Please login to add feedback.

Metadata
Type
security
Severity
medium
Karma
0
Signed
Content Type
RPM
Test Gating
Settings
Unstable by Karma
-1
Stable by Karma
2
Dates
submitted
2 years ago
in testing
2 years ago
in stable
2 years ago
BZ#1557130 CVE-2018-7750 python-paramiko: Authentication bypass in transport.py
0
0
BZ#1557132 CVE-2018-7750 python-paramiko: Authentication bypass in transport.py [epel-all]
0
0

Automated Test Results