CVE-2018-1000805

CVE Details

Release Date:	2018-10-08
Impact:	Critical	What is this?

Description

Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.

See more information about CVE-2018-1000805 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	8.8
Vector String:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Version:	3.0
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	Low
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	High
Integrity Impact:	High
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 6 (python-paramiko)	ELSA-2018-3406	2018-10-30
Oracle Linux version 7 (python-paramiko)	ELSA-2018-3347	2018-11-07
Oracle VM version 3.3 (python-paramiko)	OVMSA-2018-0270	2018-10-30
Oracle VM version 3.4 (python-paramiko)	OVMSA-2018-0270	2018-10-30