CVE-2018-7749 AsyncSSH SSH Server Authentication Bypass
CriticalCVSS 9.8
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi asyncssh(PyPI) | < 1.12.1 | 1.12.1 |
| pypi asyncssh(PyPI) | = 0.8.1 | No fix listed |
| pypi asyncssh(PyPI) | = 0.8.2 | No fix listed |
| pypi asyncssh(PyPI) | = 0.8.3 | No fix listed |
| pypi asyncssh(PyPI) | = 0.8.4 | No fix listed |
| pypi asyncssh(PyPI) | = 0.9.0 | No fix listed |
| pypi asyncssh(PyPI) | = 0.9.1 | No fix listed |
| pypi asyncssh(PyPI) | = 0.9.2 | No fix listed |
| pypi asyncssh(PyPI) | = 1.0.0 | No fix listed |
| pypi asyncssh(PyPI) | = 1.0.1 | No fix listed |
| pypi asyncssh(PyPI) | = 1.1.0 | No fix listed |
| pypi asyncssh(PyPI) | = 1.1.1 | No fix listed |
| pypi asyncssh(PyPI) | = 1.10.0 | No fix listed |
| pypi asyncssh(PyPI) | = 1.10.1 | No fix listed |
| pypi asyncssh(PyPI) | = 1.11.0 | No fix listed |
| pypi asyncssh(PyPI) | = 1.11.1 | No fix listed |
| pypi asyncssh(PyPI) | = 1.12.0 | No fix listed |
| pypi asyncssh(PyPI) | = 1.2.0 | No fix listed |
| pypi asyncssh(PyPI) | = 1.2.1 | No fix listed |
| pypi asyncssh(PyPI) | = 1.3.0 | No fix listed |
| pypi asyncssh(PyPI) | = 1.3.1 | No fix listed |
| pypi asyncssh(PyPI) | = 1.3.2 | No fix listed |
| pypi asyncssh(PyPI) | = 1.4.0 | No fix listed |
| pypi asyncssh(PyPI) | = 1.4.1 | No fix listed |
| pypi asyncssh(PyPI) | = 1.5.0 | No fix listed |
Show 66 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi asyncssh(PyPI) | = 1.5.1 | No fix listed |
| pypi asyncssh(PyPI) | = 1.5.2 | No fix listed |
| pypi asyncssh(PyPI) | = 1.5.3 | No fix listed |
| pypi asyncssh(PyPI) | = 1.5.4 | No fix listed |
| pypi asyncssh(PyPI) | = 1.5.5 | No fix listed |
| pypi asyncssh(PyPI) | = 1.5.6 | No fix listed |
| pypi asyncssh(PyPI) | = 1.6.0 | No fix listed |
| pypi asyncssh(PyPI) | = 1.6.1 | No fix listed |
| pypi asyncssh(PyPI) | = 1.6.2 | No fix listed |
| pypi asyncssh(PyPI) | = 1.7.1 | No fix listed |
| pypi asyncssh(PyPI) | = 1.7.2 | No fix listed |
| pypi asyncssh(PyPI) | = 1.7.3 | No fix listed |
| pypi asyncssh(PyPI) | = 1.8.0 | No fix listed |
| pypi asyncssh(PyPI) | = 1.8.1 | No fix listed |
| pypi asyncssh(PyPI) | = 1.9.0 | No fix listed |
| pypi asyncssh(PyPI) | = v1.12.0 | No fix listed |
| pypi asyncssh(PyPI) | = v1.11.1 | No fix listed |
| pypi asyncssh(PyPI) | = v1.11.0 | No fix listed |
| pypi asyncssh(PyPI) | = v1.10.1 | No fix listed |
| pypi asyncssh(PyPI) | = v1.10.0 | No fix listed |
| pypi asyncssh(PyPI) | = v1.9.0 | No fix listed |
| pypi asyncssh(PyPI) | = v1.8.1 | No fix listed |
| pypi asyncssh(PyPI) | = v1.8.0 | No fix listed |
| pypi asyncssh(PyPI) | = v1.7.3 | No fix listed |
| pypi asyncssh(PyPI) | = v1.7.2 | No fix listed |
| pypi asyncssh(PyPI) | = v1.7.1 | No fix listed |
| pypi asyncssh(PyPI) | = v1.6.2 | No fix listed |
| pypi asyncssh(PyPI) | = v1.6.1 | No fix listed |
| pypi asyncssh(PyPI) | = v1.6.0 | No fix listed |
| pypi asyncssh(PyPI) | = v1.5.6 | No fix listed |
| pypi asyncssh(PyPI) | = v1.5.5 | No fix listed |
| pypi asyncssh(PyPI) | = v1.5.4 | No fix listed |
| pypi asyncssh(PyPI) | = v1.5.3 | No fix listed |
| pypi asyncssh(PyPI) | = v1.5.2 | No fix listed |
| pypi asyncssh(PyPI) | = v1.5.1 | No fix listed |
| pypi asyncssh(PyPI) | = v1.5.0 | No fix listed |
| pypi asyncssh(PyPI) | = v1.4.1 | No fix listed |
| pypi asyncssh(PyPI) | = v1.4.0 | No fix listed |
| pypi asyncssh(PyPI) | = v1.3.2 | No fix listed |
| pypi asyncssh(PyPI) | = v1.3.1 | No fix listed |
| pypi asyncssh(PyPI) | = v1.3.0 | No fix listed |
| pypi asyncssh(PyPI) | = v1.2.1 | No fix listed |
| pypi asyncssh(PyPI) | = v1.2.0 | No fix listed |
| pypi asyncssh(PyPI) | = v1.1.1 | No fix listed |
| pypi asyncssh(PyPI) | = v1.1.0 | No fix listed |
| pypi asyncssh(PyPI) | = v1.0.1 | No fix listed |
| pypi asyncssh(PyPI) | = v1.0.0 | No fix listed |
| pypi asyncssh(PyPI) | = v0.9.2 | No fix listed |
| pypi asyncssh(PyPI) | = v0.9.1 | No fix listed |
| pypi asyncssh(PyPI) | = v0.9.0 | No fix listed |
| pypi asyncssh(PyPI) | = v0.8.4 | No fix listed |
| pypi asyncssh(PyPI) | = v0.8.3 | No fix listed |
| pypi asyncssh(PyPI) | = v0.8.2 | No fix listed |
| pypi asyncssh(PyPI) | = v0.8.1 | No fix listed |
| pypi asyncssh(PyPI) | = v0.8.0 | No fix listed |
| pypi asyncssh(PyPI) | = v0.7.0 | No fix listed |
| pypi asyncssh(PyPI) | = v0.6.0 | No fix listed |
| pypi asyncssh(PyPI) | = v0.5.0 | No fix listed |
| pypi asyncssh(PyPI) | = v0.4.0 | No fix listed |
| pypi asyncssh(PyPI) | = v0.3.0 | No fix listed |
| pypi asyncssh(PyPI) | = v0.2.0 | No fix listed |
| pypi asyncssh(PyPI) | = v0.1.0 | No fix listed |
| debian/python-asyncssh(Debian:12) | < 1.12.1-1 | 1.12.1-1 |
| debian/python-asyncssh(Debian:13) | < 1.12.1-1 | 1.12.1-1 |
| debian/python-asyncssh(Debian:14) | < 1.12.1-1 | 1.12.1-1 |
| asyncssh project asyncssh | < 1.12.1 | 1.12.1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch third-party-advisory
- github.com
- github.com product
- [asyncssh-announce] 20180310 AsyncSSH 1.12.1 released, with important security fix! mailing-list
- github.com vendor-advisory
- Debian Security Tracker CVE-2018-7749 vendor-advisory
- bugs.debian.org issue-tracking