CVE-2018-7750

It was found that when acting as an SSH server, paramiko did not properly check whether authentication is completed before processing other requests. A customized SSH client could use this to bypass authentication when accessing any resources controlled by paramiko.

This flaw is a user authentication bypass in the SSH Server functionality of paramiko (normally used by subclassing paramiko.ServerInterface). Where paramiko is used only for its client-side functionality (e.g. paramiko.SSHClient), the vulnerability is not exposed and thus cannot be exploited.

The following Red Hat products use paramiko only in client-side mode. Server side functionality is not used.

• Red Hat Ceph Storage 2
• Red Hat CloudForms 4
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Virtualization
• Red Hat Gluster Storage 3
• Red Hat Openshift Container Platform
• Red Hat Quick Cloud Installer
• Red Hat Satellite 6
• Red Hat Storage Console 2
• Red Hat OpenStack Platform
• Red Hat Update Infrastructure

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.