3.5.0
14 years ago
3 months ago
Known vulnerabilities in the paramiko package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for freeVulnerability | Vulnerable Version |
---|---|
paramiko is a library for making SSH2 connections (client or server). Affected versions of this package are vulnerable to Authentication Bypass by Capture-replay during the establishment of the secure channel. An attacker can manipulate handshake sequence numbers to delete messages sent immediately after the channel is established. Note:
Impact: While cryptographically novel, there is no discernable impact on the integrity of SSH traffic beyond giving the attacker the ability to delete the message that enables some features related to keystroke timing obfuscation. To successfully carry out the exploitation, the connection needs to be protected using either the How to fix Authentication Bypass by Capture-replay? Upgrade | [,3.4.0) |
paramiko is a library for making SSH2 connections (client or server). Affected versions of this package are vulnerable to Race Condition when creating new private key files using How to fix Race Condition? Upgrade | [,2.10.1) |
paramiko is a library for making SSH2 connections (client or server). Affected versions of this package are vulnerable to Authentication Bypass. The SSH server did not use correct access control, which allowed the server to bypass an unauthenticated user as authenticated one. How to fix Authentication Bypass? Upgrade | [1.5.1,2.0.9) |