paramiko: CVE-2018-1000805: Authentication bypass in auth_handler.py

Debian Bug report logs - #910760
paramiko: CVE-2018-1000805: Authentication bypass in auth_handler.py

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: paramiko: CVE-2018-1000805: Authentication bypass in auth_handler.py

Date: Wed, 10 Oct 2018 21:48:39 +0200

Source: paramiko
Version: 2.0.0-1
Severity: important
Tags: patch security upstream
Forwarded: https://github.com/paramiko/paramiko/issues/1283

Hi,

The following vulnerability was published for paramiko.

CVE-2018-1000805[0]:
| Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6
| contains a Incorrect Access Control vulnerability in SSH server that
| can result in RCE. This attack appear to be exploitable via network
| connectivity.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-1000805
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000805
[1] https://github.com/paramiko/paramiko/issues/1283
[2] https://github.com/paramiko/paramiko/commit/56c96a659658acdbb873aef8809a7b508434dcce

Regards,
Salvatore

Send a report that this bug log contains spam.