Sign in
Deutsch English Español Polski
Critical

Paramiko not properly checking authentication before processing other requests

  • Disclosed: 13.03.2018
  • Updated: 11.10.2026 12:19

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) paramiko >= 2.0.0, < 2.0.8, >= 2.1.0, < 2.1.5, >= 2.2.0, < 2.2.3, >= 2.3.0, < 2.3.2, >= 2.4.0, < 2.4.1, >= 1.18.0, < 1.18.5, < 1.17.6 2.0.8, 2.1.5, 2.2.3, 2.3.2, 2.4.1, 1.18.5, 1.17.6

References

CVSS score 9.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-287
Platform
Python (PyPI)
Package
paramiko
Disclosed
13.03.2018
Updated
11.10.2026 12:19

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2018-19 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-232r-66cg-79px - CC BY 4.0

Vulnerability history: paramiko

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries
6
First → latest
01.2008 05.2026
Without a fix
1
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 3
  • Medium 1
  • Low 1

Disclosures per year

earlier: 1

  1. Paramiko rsakey.py allows the SHA-1 algorithm
    Low · 3.4 CVE-2026-44405 <= 4.0.0 no fix
  2. Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin
    Medium · 5.9 CVE-2023-48795 >= 2.5.0, < 3.4.0 3.4.0
  3. Race Condition in Paramiko
    High · 5.9 CVE-2022-24302 >= 2.10.0, < 2.10.1, >= 2.9.0, < 2.9.3 2.10.1, 2.9.3
  4. Paramiko Authentication Bypass vulnerability
    High · 8.8 CVE-2018-1000805 >= 2.4.0, < 2.4.2, >= 2.3.0, < 2.3.3, >= 2.2.0, < 2.2.4, >= 2.1.0, < 2.1.6, >= 1.5.1, < 2.0.9 2.4.2, 2.3.3, 2.2.4, 2.1.6, 2.0.9
  5. Paramiko not properly checking authentication before processing other requests this entry
    Critical · 9.8 CVE-2018-7750 >= 2.0.0, < 2.0.8, >= 2.1.0, < 2.1.5, >= 2.2.0, < 2.2.3, >= 2.3.0, < 2.3.2, >= 2.4.0, < 2.4.1, >= 1.18.0, < 1.18.5, < 1.17.6 2.0.8, 2.1.5, 2.2.3, 2.3.2, 2.4.1, 1.18.5, 1.17.6
  6. common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by pred
    High · 6.5 CVE-2008-0299 < 1.7.2 1.7.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.