8.8

CVE-2018-1000805

Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.

Data is provided by the National Vulnerability Database (NVD)
Paramiko ≫ Paramiko Version1.17.6
Paramiko ≫ Paramiko Version1.18.5
Paramiko ≫ Paramiko Version2.0.8
Paramiko ≫ Paramiko Version2.1.5
Paramiko ≫ Paramiko Version2.2.3
Paramiko ≫ Paramiko Version2.3.2
Paramiko ≫ Paramiko Version2.4.1
Redhat ≫ Ansible Tower Version3.3
Redhat ≫ Virtualization Host Version4.0
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
Canonical ≫ Ubuntu Linux Version12.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.10
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.42% 0.614
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://usn.ubuntu.com/3796-1/
Third Party Advisory
https://usn.ubuntu.com/3796-2/
Third Party Advisory
https://usn.ubuntu.com/3796-3/
Third Party Advisory