CVE-2018-1000805

Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.

This flaw is a user authentication bypass in the SSH Server functionality of paramiko (normally used by subclassing paramiko.ServerInterface). Where paramiko is used only for its client-side functionality (e.g. paramiko.SSHClient), the vulnerability is not exposed and thus cannot be exploited.

The following Red Hat products use paramiko only in client-side mode. Server side functionality is not used.

• Red Hat Ansible Engine 2
• Red Hat Ceph Storage 2
• Red Hat CloudForms 4
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Virtualization
• Red Hat Gluster Storage 3
• Red Hat Openshift Container Platform
• Red Hat Quick Cloud Installer
• Red Hat Satellite 6
• Red Hat Storage Console 2
• Red Hat OpenStack Platform
• Red Hat Update Infrastructure

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.