{"schema_version":"1.8.0","id":"CVE-2018-1000805","published":"2018-10-08T15:29:00.713Z","modified":"2026-08-07T11:31:14.891818981Z","aliases":["GHSA-f2j6-wrhh-v25m","PYSEC-2018-69"],"related":["SUSE-SU-2019:0174-1","SUSE-SU-2019:0396-1","SUSE-SU-2019:0481-1","SUSE-SU-2020:1274-1","SUSE-SU-2021:0038-1","SUSE-SU-2022:3730-1","openSUSE-SU-2019:0129-1","openSUSE-SU-2024:11249-1","openSUSE-SU-2026:11025-1"],"details":"Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/paramiko/paramiko","events":[{"introduced":"ac3f78648d2f48c3a99bbf0295245954a34ab46d"},{"last_affected":"8bd1506c816b025b4a74e1b254e4879518ae696d"}],"database_specific":{"cpe":["cpe:2.3:a:paramiko:paramiko:1.17.6:*:*:*:*:*:*:*","cpe:2.3:a:paramiko:paramiko:1.18.5:*:*:*:*:*:*:*","cpe:2.3:a:paramiko:paramiko:2.0.8:*:*:*:*:*:*:*","cpe:2.3:a:paramiko:paramiko:2.1.5:*:*:*:*:*:*:*","cpe:2.3:a:paramiko:paramiko:2.2.3:*:*:*:*:*:*:*","cpe:2.3:a:paramiko:paramiko:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:paramiko:paramiko:2.4.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.17.6"},{"last_affected":"1.17.6"},{"introduced":"1.18.5"},{"last_affected":"1.18.5"},{"introduced":"2.0.8"},{"last_affected":"2.0.8"},{"introduced":"2.1.5"},{"last_affected":"2.1.5"},{"introduced":"2.2.3"},{"last_affected":"2.2.3"},{"introduced":"2.3.2"},{"last_affected":"2.3.2"},{"introduced":"2.4.1"},{"last_affected":"2.4.1"}],"source":"CPE_STRING"}}],"versions":["1.17.6","1.18.5","2.0.8","2.1.5","2.2.3","2.3.2","2.4.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000805.json"}}],"references":[{"type":"WEB","url":"https://herolab.usd.de/wp-content/uploads/sites/4/usd20180023.txt"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHBA-2018:3497"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3347"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3406"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3505"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2018/10/msg00018.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00025.html"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/3796-1/"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/3796-2/"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/3796-3/"},{"type":"FIX","url":"https://github.com/paramiko/paramiko/issues/1283"}],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.04"},{"last_affected":"12.04"},{"introduced":"14.04"},{"last_affected":"14.04"},{"introduced":"16.04"},{"last_affected":"16.04"},{"introduced":"18.04"},{"last_affected":"18.04"},{"introduced":"18.10"},{"last_affected":"18.10"}],"source":"CPE_STRING","vendor_product":"canonical:ubuntu_linux"},{"cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"cpes":["cpe:2.3:a:redhat:ansible_tower:3.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.3"},{"last_affected":"3.3"}],"source":"CPE_STRING","vendor_product":"redhat:ansible_tower"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.0"},{"last_affected":"6.0"},{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_desktop"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.0"},{"last_affected":"6.0"},{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.4"},{"last_affected":"6.4"},{"introduced":"6.5"},{"last_affected":"6.5"},{"introduced":"6.6"},{"last_affected":"6.6"},{"introduced":"7.6"},{"last_affected":"7.6"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_aus"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server_eus:6.7:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.7"},{"last_affected":"6.7"},{"introduced":"7.6"},{"last_affected":"7.6"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_eus"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server_tus:6.6:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.6"},{"last_affected":"6.6"},{"introduced":"7.6"},{"last_affected":"7.6"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_tus"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.0"},{"last_affected":"6.0"},{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_workstation"},{"cpes":["cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.0"},{"last_affected":"4.0"}],"source":"CPE_STRING","vendor_product":"redhat:virtualization_host"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}