Description
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | paramiko | 2.4.2-0.1 | — |
| Debian 13 | paramiko | 2.4.2-0.1 | — |
| Debian 12 | paramiko | 2.4.2-0.1 | — |
| Debian 9 | paramiko | 2.0.0-1+deb9u1 | DLA-2860-1 |
| Debian 8 | paramiko | 1.15.1-1+deb8u1 | DLA-1556-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | paramiko | 1.16.0-1ubuntu0.1 | USN-3603-1 |
| Ubuntu 14.04 LTS | paramiko | 1.10.1-1git1ubuntu0.1 | USN-3603-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | python-paramiko +1 | 2.1.1-4.el7 | RHSA-2018:1274 |
| RHEL 7 | rhvm-appliance | 2:4.2-20180504.0.el7 | RHSA-2018:1525 |
| RHEL 6 | python-paramiko | 1.7.5-4.el6_9 | RHSA-2018:1124 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | python-paramiko +1 | 2.1.1-4.el7 | RHSA-2018:1274 |
| Red Hat Rhel Extras Other 7 | python-paramiko +1 | 2.1.1-4.el7 | RHSA-2018:0591 |
| RHEL 6.7 EUS | python-paramiko | 1.7.5-4.el6_7 | RHSA-2018:1125 |
| RHEL 6.6 TUS | python-paramiko | 1.7.5-4.el6_6 | RHSA-2018:1125 |
| RHEL 6.6 AUS | python-paramiko | 1.7.5-4.el6_6 | RHSA-2018:1125 |
| RHEL 6.5 AUS | python-paramiko | 1.7.5-4.el6_5 | RHSA-2018:1125 |
| RHEL 6.4 AUS | python-paramiko | 1.7.5-4.el6_4 | RHSA-2018:1125 |
| Red Hat CloudForms 5 | ansible +1 | 2.4.4.0-1.el7ae | RHSA-2018:1972, RHSA-2018:1328 |
| Red Hat CloudForms 5 | ansible-tower +3 | 3.2.4-1.el7at | RHSA-2018:1328 |
| Red Hat CloudForms 5 | ansible-tower-setup +1 | 3.1.7-1.el7at | RHSA-2018:1972, RHSA-2018:1328 |
| Red Hat CloudForms 5 | cfme +2 | 5.8.4.5-1.el7cf | RHSA-2018:1972, RHSA-2018:1328 |
| Red Hat CloudForms 5 | cfme-appliance-tools +2 | 5.9.2.4-1.el7cf | RHSA-2018:1328 |
| Red Hat CloudForms 5 | dbus-api-service | 1.0.1-3.el7cf | RHSA-2018:1328 |
| Red Hat CloudForms 5 | httpd-configmap-generator | 0.2.1-2.el7cf | RHSA-2018:1328 |
| Red Hat CloudForms 5 | postgresql96 +9 | 9.6.6-1PGDG.el7 | RHSA-2018:1328 |
| Red Hat CloudForms 5 | python-paramiko +1 | 2.1.1-4.el7 | RHSA-2018:1972, RHSA-2018:1328 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-json +1 | 2.1.0-1.el7cf | RHSA-2018:1972, RHSA-2018:1328 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-qpid_proton +1 | 0.22.0-2.el7cf | RHSA-2018:1328 |
| Red Hat Ansible Engine 2 | python-paramiko | 2.1.1-4.el7 | RHSA-2018:1213, RHSA-2018:0646 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | python-paramiko | 1.15.2-2.9.1 | SUSE-SU-2018:2777-1, SUSE-SU-2018:1971-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 7 | python-paramiko | 2.0.8-3.3.1 | SUSE-SU-2018:0844-1 |
| SUSE OpenStack Cloud 6 | python-paramiko | 1.15.2-2.6.1 | SUSE-SU-2018:0873-1 |
| SUSE Enterprise Storage 5 | python-paramiko | 2.0.8-3.3.1 | SUSE-SU-2018:1850-1 |
| SUSE Enterprise Storage 4 | python-paramiko | 2.0.8-3.3.1 | SUSE-SU-2018:0844-1 |
| SUSE Enterprise Storage 3 | python-paramiko | 1.15.2-2.6.1 | SUSE-SU-2018:0873-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-paramiko | 2.7.2-3.7 | openSUSE-SU-2026:11025-1, openSUSE-SU-2024:11249-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-paramiko | 2.4.1-r0 | — |
| Alpine v3.23 | py3-paramiko | 2.4.1-r0 | — |
| Alpine v3.22 | py3-paramiko | 2.4.1-r0 | — |
| Alpine v3.21 | py3-paramiko | 2.4.1-r0 | — |
| Alpine v3.20 | py3-paramiko | 2.4.1-r0 | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | py3-paramiko | 2.4.1-r0 | — |
| Alpine v3.18 | py3-paramiko | 2.4.1-r0 | — |
| Alpine v3.17 | py3-paramiko | 2.4.1-r0 | — |
| Alpine v3.16 | py3-paramiko | 2.4.1-r0 | — |
| Alpine v3.15 | py3-paramiko | 2.4.1-r0 | — |
| Alpine v3.14 | py3-paramiko | 2.4.1-r0 | — |
| Alpine v3.13 | py3-paramiko | 2.4.1-r0 | — |
| Alpine v3.12 | py3-paramiko | 2.4.1-r0 | — |
| Alpine v3.11 | py3-paramiko | 2.4.1-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Paramiko 2.4.1 - Authentication Bypass EDB-45712 · remote · Oct 29, 2018
GitHub 2 repositories
-
jm33-m0/CVE-2018-7750 ★ 21 · Nov 6, 2018
an RCE (remote command execution) approach of CVE-2018-7750
-
tlavi00/CVE-2018-7750 ★ 0 · Dec 13, 2024
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | paramiko | >= 2.0.0, < 2.0.8 | 2.0.8 | GHSA-232r-66cg-79px |
| PyPI | paramiko | >= 2.1.0, < 2.1.5 | 2.1.5 | GHSA-232r-66cg-79px |
| PyPI | paramiko | >= 2.2.0, < 2.2.3 | 2.2.3 | GHSA-232r-66cg-79px |
| PyPI | paramiko | >= 2.3.0, < 2.3.2 | 2.3.2 | GHSA-232r-66cg-79px |
| PyPI | paramiko | >= 2.4.0, < 2.4.1 | 2.4.1 | GHSA-232r-66cg-79px |
| PyPI | paramiko | >= 1.18.0, < 1.18.5 | 1.18.5 | GHSA-232r-66cg-79px |
| PyPI | paramiko | < 1.17.6 | 1.17.6 | GHSA-232r-66cg-79px |
| PyPI | paramiko | < 1.17.6 · >= 1.18.0, < 1.18.5 · >= 2.0.0, < 2.0.8 · >= 2.1.0, < 2.1.5 · >= 2.2.0, < 2.2.3 · >= 2.3.0, < 2.3.2 | 1.17.6, 1.18.5, 2.0.8, 2.1.5, 2.2.3, 2.3.2 | PYSEC-2018-19 |
Advisories 19
- RHSA-2018:1525 Red Hat Security Advisory: rhvm-appliance security and enhancement update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:1972 Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2018:1328 Red Hat Security Advisory: CloudForms 4.6.2 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2018:1274 Red Hat Security Advisory: python-paramiko security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2018:1213 Red Hat Security Advisory: python-paramiko security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2018:1124 Red Hat Security Advisory: python-paramiko security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2018:1125 Red Hat Security Advisory: python-paramiko security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2018:0646 Red Hat Security Advisory: python-paramiko security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2018:0591 Red Hat Security Advisory: python-paramiko security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- openSUSE-SU-2026:11025-1 python311-paramiko-5.0.0-1.1 on GA media SUSE / openSUSE Security Updates · Jun 14, 2026
- DLA-2860-1 paramiko - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1556-1 paramiko - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3603-1 paramiko vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2018:1971-1 Security update for python-paramiko SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:0873-1 Security update for python-paramiko SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:0844-1 Security update for python-paramiko SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11249-1 python-paramiko-doc-2.7.2-3.7 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2777-1 Security update for python-paramiko SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:1850-1 Security update for python-paramiko SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2018:1124 vendor-advisory
- 45712 exploit
- https://github.com/paramiko/paramiko/issues/1175
- RHSA-2018:1125 vendor-advisory
- RHSA-2018:1972 vendor-advisory
- RHSA-2018:1274 vendor-advisory
- [debian-lts-announce] 20181027 [SECURITY] [DLA 1556-1] paramiko security update mailing-list
- USN-3603-2 vendor-advisory
- RHSA-2018:0646 vendor-advisory
- RHSA-2018:1213 vendor-advisory
- USN-3603-1 vendor-advisory
- RHSA-2018:1525 vendor-advisory
- RHSA-2018:1328 vendor-advisory
- RHSA-2018:0591 vendor-advisory
- 103713 vdb-entry
- https://github.com/paramiko/paramiko/commit/fa29bd8446c8eab237f5187d28787727b4610516
- https://github.com/paramiko/paramiko/blob/master/sites/www/changelog.rst
- [debian-lts-announce] 20211228 [SECURITY] [DLA 2860-1] paramiko security update mailing-list