CVE-2018-1000805

Description

Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.

How to fix CVE-2018-1000805

To remediate CVE-2018-1000805, upgrade the affected package to a fixed version below.

• Alpine/py3-paramiko—upgrade to 2.4.2-r0 or later
• —upgrade to 2.1.6-r0 or later
• —upgrade to 2.0.0-1+deb9u1 or later
• —upgrade to 1.15.1-1+deb8u1 or later
• —upgrade to 2.4.2-0.1 or later
• —upgrade to 2.4.2 or later
• —upgrade to 2.0.9 or later

Is CVE-2018-1000805 being exploited?

Low — EPSS is 0.9%, meaning exploitation activity has not been observed at scale.

Affected packages (7)

• from 0, < 2.4.2-r0
• from 0, < 2.1.6-r0
• from 0, < 2.0.0-1+deb9u1
• from 0, < 1.15.1-1+deb8u1
• from 0, < 2.4.2-0.1
• >= 2.4.0, < 2.4.2
• >= 1.5.1, < 2.0.9

CVSS scores

References (20)

• ADVISORYgithub.com/advisories/GHSA-f2j6-wrhh-v25m
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-1000805
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2018-1000805
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2018-1000805
• PATCH