High USN-3796-1 1 CVE

paramiko vulnerability

Published Oct 17, 2018 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Daniel Hoffman discovered that Paramiko incorrectly handled authentication
when being used as a server. A remote attacker could use this issue to
bypass authentication without any credentials.

Fixed packages 3

Release	Package	Fixed in
Ubuntu · 14.04 LTS 14.04:LTS	paramiko	1.10.1-1git1ubuntu0.2
Ubuntu · 16.04 LTS 16.04:LTS	paramiko	1.16.0-1ubuntu0.2
Ubuntu · 18.04 LTS 18.04:LTS	paramiko	2.0.0-1ubuntu1.1

Vulnerabilities 1

High 8.8

CVE-2018-1000805

Paramiko Authentication Bypass vulnerability

Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.

paramiko paramiko paramiko py3-paramiko Debian Ubuntu Alpine PyPI

Oct 8, 2018

References

report
https://ubuntu.com/security/CVE-2018-1000805