PT-2018-18256 · Asyncssh+2 · Asyncssh+2

Matthijs Kooijman · CVE-2018-7749 · Published 2018-03-12 · Updated 2024-04-08

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: AsyncSSH versions prior to 1.12.1

Description: The issue arises from the SSH server implementation not properly checking whether authentication is completed before processing other requests. This allows a customized SSH client to bypass the authentication step.

Recommendations: For versions prior to 1.12.1, update to version 1.12.1 or later to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2019-4164

CVE-2018-7749

GHSA-97CV-6PJF-5F9Q

PYSEC-2018-108

USN-4854-1

Affected Products

Alt Linux

Asyncssh

Ubuntu

References · 18

• https://ubuntu.com/security/CVE-2018-7749 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-97cv-6pjf-5f9q · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-7749 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2018-108 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7749 · Security Note
• https://ubuntu.com/security/notices/USN-4854-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-7749 · Security Note
• https://osv.dev/vulnerability/USN-4854-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7749 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-7749 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-7749 · Vendor Advisory
• https://github.com/ronf/asyncssh · Note
• https://github.com/ronf/asyncssh/commit/c161e26cdc0d41b745b63d9f17b437f073bf7ba4 · Note
• https://github.com/ronf/asyncssh/commit/16e6ebfa893167c7d9d3f6dc7a2c0d197e47f43a · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/asyncssh/PYSEC-2018-108.yaml · Note