PT-2018-18256 · Asyncssh+2 · Asyncssh+2

Matthijs Kooijman · Publicado 2018-03-12 · Atualizado 2024-04-08 · CVE-2018-7749

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: AsyncSSH versions prior to 1.12.1

Description: The issue arises from the SSH server implementation not properly checking whether authentication is completed before processing other requests. This allows a customized SSH client to bypass the authentication step.

Recommendations: For versions prior to 1.12.1, update to version 1.12.1 or later to resolve the issue.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

ALT-PU-2019-4164

CVE-2018-7749

GHSA-97CV-6PJF-5F9Q

PYSEC-2018-108

USN-4854-1

Produtos afetados

Alt Linux

Asyncssh

Ubuntu

Referências · 17

• https://github.com/ronf/asyncssh · Nota
• https://github.com/ronf/asyncssh/commit/c161e26cdc0d41b745b63d9f17b437f073bf7ba4 · Nota
• https://github.com/ronf/asyncssh/commit/16e6ebfa893167c7d9d3f6dc7a2c0d197e47f43a · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/asyncssh/PYSEC-2018-108.yaml · Nota
• https://groups.google.com/forum/#%21msg/asyncssh-announce/57_5O7kiHSA/8BXZ_hxHAQAJ · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-7749 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-97cv-6pjf-5f9q · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-7749 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-7749 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-7749 · Aviso do Fabricante
• https://groups.google.com/forum/#!msg/asyncssh-announce/57_5O7kiHSA/8BXZ_hxHAQAJ · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-7749 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-7749 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-4854-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-4854-1 · Aviso do Fabricante