Python Paramiko versions 2.3.2 and 2.4.1 are vulnerable to an authentication bypass in `paramiko/auth_handler.py`. A remote attacker could exploit this vulnerability in Paramiko SSH servers to execute arbitrary code. Note that applications using Paramiko only as a client (such as ansible) are not affected by this.

There is also an additional fix preventing `MSG_UNIMPLEMENTED` feedback loops that could manifest when both ends of a connection are Paramiko-based.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-3796-1 fixed a vulnerability in Paramiko. This update provides the corresponding update for Ubuntu 18.10.

Daniel Hoffman discovered that Paramiko incorrectly handled authentication when being used as a server. A remote attacker could use this issue to bypass authentication without any credentials.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:3406 advisory.

    The python-paramiko package provides a Python module that implements the SSH2 protocol for encrypted and     authenticated connections to remote machines. Unlike SSL, the SSH2 protocol does not require hierarchical     certificates signed by a powerful central authority. The protocol also includes the ability to open     arbitrary channels to remote services across an encrypted tunnel.

    Security Fix(es):

    * python-paramiko: Authentication bypass in auth_handler.py (CVE-2018-1000805)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - python-paramiko: Authentication bypass in     auth_handler.py (CVE-2018-1000805)

An update for python-paramiko is now available for Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 6.4 Advanced Update Support, Red Hat Enterprise Linux 6.5 Advanced Update Support, Red Hat Enterprise Linux 6.6 Advanced Update Support, Red Hat Enterprise Linux 6.6 Telco Extended Update Support, and Red Hat Enterprise Linux 6.7 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The python-paramiko package provides a Python module that implements the SSH2 protocol for encrypted and authenticated connections to remote machines. Unlike SSL, the SSH2 protocol does not require hierarchical certificates signed by a powerful central authority. The protocol also includes the ability to open arbitrary channels to remote services across an encrypted tunnel.

Security Fix(es) :

* python-paramiko: Authentication bypass in auth_handler.py (CVE-2018-1000805)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
120878	Fedora 29 : python-paramiko (2018-ea6b328afd)	Nessus	Fedora Local Security Checks	2019/1/3	2024/6/28	high
118104	Fedora 27 : python-paramiko (2018-aff51f5e62)	Nessus	Fedora Local Security Checks	2018/10/15	2024/7/31	high
118326	Ubuntu 18.10 : Paramiko vulnerability (USN-3796-3)	Nessus	Ubuntu Local Security Checks	2018/10/23	2023/5/11	high
118553	RHEL 6 : python-paramiko (RHSA-2018:3406)	Nessus	Red Hat Local Security Checks	2018/10/31	2024/11/5	high
118727	Scientific Linux Security Update : python-paramiko on SL6.x (noarch) (20181031)	Nessus	Scientific Linux Local Security Checks	2018/11/5	2024/7/26	high
118838	CentOS 6 : python-paramiko (CESA-2018:3406)	Nessus	CentOS Local Security Checks	2018/11/9	2021/4/14	high

检测

插件搜索

high

high

high

high

high

high