{
  "threat_severity" : "Critical",
  "public_date" : "2018-09-07T00:00:00Z",
  "bugzilla" : {
    "description" : "python-paramiko: Authentication bypass in auth_handler.py",
    "id" : "1637263",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1637263"
  },
  "cvss3" : {
    "cvss3_base_score" : "9.8",
    "cvss3_scoring_vector" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-305",
  "details" : [ "Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity." ],
  "statement" : "This flaw is a user authentication bypass in the SSH Server functionality of paramiko (normally used by subclassing `paramiko.ServerInterface`). Where paramiko is used only for its client-side functionality (e.g. `paramiko.SSHClient`), the vulnerability is not exposed and thus cannot be exploited.\nThe following Red Hat products use paramiko only in client-side mode. Server side functionality is not used.\n* Red Hat Ansible Engine 2\n* Red Hat Ceph Storage 2\n* Red Hat CloudForms 4\n* Red Hat Enterprise Linux 7\n* Red Hat Enterprise Virtualization\n* Red Hat Gluster Storage 3\n* Red Hat Openshift Container Platform\n* Red Hat Quick Cloud Installer\n* Red Hat Satellite 6\n* Red Hat Storage Console 2\n* Red Hat OpenStack Platform\n* Red Hat Update Infrastructure",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "release_date" : "2018-10-30T00:00:00Z",
    "advisory" : "RHSA-2018:3406",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6",
    "package" : "python-paramiko-0:1.7.5-5.el6_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6.4 Advanced Update Support",
    "release_date" : "2018-10-30T00:00:00Z",
    "advisory" : "RHSA-2018:3406",
    "cpe" : "cpe:/o:redhat:rhel_aus:6.4",
    "package" : "python-paramiko-0:1.7.5-4.el6_4.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6.5 Advanced Update Support",
    "release_date" : "2018-10-30T00:00:00Z",
    "advisory" : "RHSA-2018:3406",
    "cpe" : "cpe:/o:redhat:rhel_aus:6.5",
    "package" : "python-paramiko-0:1.7.5-4.el6_5.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6.6 Advanced Update Support",
    "release_date" : "2018-10-30T00:00:00Z",
    "advisory" : "RHSA-2018:3406",
    "cpe" : "cpe:/o:redhat:rhel_aus:6.6",
    "package" : "python-paramiko-0:1.7.5-4.el6_6.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6.6 Telco Extended Update Support",
    "release_date" : "2018-10-30T00:00:00Z",
    "advisory" : "RHSA-2018:3406",
    "cpe" : "cpe:/o:redhat:rhel_tus:6.6",
    "package" : "python-paramiko-0:1.7.5-4.el6_6.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6.7 Extended Update Support",
    "release_date" : "2018-10-30T00:00:00Z",
    "advisory" : "RHSA-2018:3406",
    "cpe" : "cpe:/o:redhat:rhel_eus:6.7",
    "package" : "python-paramiko-0:1.7.5-4.el6_7.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2018-10-30T00:00:00Z",
    "advisory" : "RHSA-2018:3347",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "python-paramiko-0:2.1.1-9.el7"
  }, {
    "product_name" : "Red Hat Virtualization 4 for Red Hat Enterprise Linux 7",
    "release_date" : "2018-11-05T00:00:00Z",
    "advisory" : "RHBA-2018:3497",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7::hypervisor",
    "package" : "rhvm-appliance-0:4.2-20181026.1.el7",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Virtualization 4 for Red Hat Enterprise Linux 7",
    "release_date" : "2018-11-05T00:00:00Z",
    "advisory" : "RHSA-2018:3470",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7::hypervisor",
    "package" : "imgbased-0:1.0.29-1.el7ev"
  }, {
    "product_name" : "Red Hat Virtualization 4 for Red Hat Enterprise Linux 7",
    "release_date" : "2018-11-05T00:00:00Z",
    "advisory" : "RHSA-2018:3470",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7::hypervisor",
    "package" : "redhat-release-virtualization-host-0:4.2-7.3.el7"
  }, {
    "product_name" : "Red Hat Virtualization 4 for Red Hat Enterprise Linux 7",
    "release_date" : "2018-11-05T00:00:00Z",
    "advisory" : "RHSA-2018:3470",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7::hypervisor",
    "package" : "redhat-virtualization-host-0:4.2-20181026.0.el7_6"
  } ],
  "package_state" : [ {
    "product_name" : "CloudForms Management Engine 5",
    "fix_state" : "Out of support scope",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:cloudforms_managementengine:5",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Ansible Engine 2",
    "fix_state" : "Will not fix",
    "package_name" : "ansible",
    "cpe" : "cpe:/a:redhat:ansible_engine:2",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Ceph Storage 2",
    "fix_state" : "Affected",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:ceph_storage:2",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)",
    "fix_state" : "Will not fix",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:openstack:7",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.2",
    "fix_state" : "Out of support scope",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:openshift:3.2"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.3",
    "fix_state" : "Out of support scope",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:openshift:3.3"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.4",
    "fix_state" : "Out of support scope",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:openshift:3.4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.5",
    "fix_state" : "Out of support scope",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:openshift:3.5"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.6",
    "fix_state" : "Out of support scope",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:openshift:3.6"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.7",
    "fix_state" : "Out of support scope",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:openshift:3.7"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.9",
    "fix_state" : "Out of support scope",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:openshift:3.9",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift Enterprise 3.0",
    "fix_state" : "Out of support scope",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:openshift:3.0"
  }, {
    "product_name" : "Red Hat OpenShift Enterprise 3.1",
    "fix_state" : "Out of support scope",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:openshift:3.1"
  }, {
    "product_name" : "Red Hat OpenStack Platform 10 (Newton)",
    "fix_state" : "Will not fix",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:openstack:10",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenStack Platform 12 (Pike)",
    "fix_state" : "Will not fix",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:openstack:12",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenStack Platform 14 (Rocky)",
    "fix_state" : "Will not fix",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:openstack:14",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenStack Platform 8 (Liberty)",
    "fix_state" : "Will not fix",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:openstack:8",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenStack Platform 9 (Mitaka)",
    "fix_state" : "Will not fix",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:openstack:9",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Satellite 6",
    "fix_state" : "Not affected",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:satellite:6"
  }, {
    "product_name" : "Red Hat Storage 3",
    "fix_state" : "Fix deferred",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:storage:3",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Update Infrastructure 3 for Cloud Providers",
    "fix_state" : "Will not fix",
    "package_name" : "python-paramiko",
    "cpe" : "cpe:/a:redhat:rhui:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2018-1000805\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-1000805" ],
  "name" : "CVE-2018-1000805",
  "csaw" : false
}