CVE-2018-7749: Critical severity Asyncssh Project Asyncssh vulnerability
The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/AsyncSSHto a version that resolves this vulnerability.Fixed in 1.12.1
Event History
Frequently Asked Questions
What is CVE-2018-7749?
CVE-2018-7749 is a vulnerability in the SSH server implementation of AsyncSSH before version 1.12.1 that allows a customized SSH client to skip the authentication step.
What is the severity of CVE-2018-7749?
CVE-2018-7749 has a severity rating of 9.8 (critical).
How does CVE-2018-7749 impact affected software?
CVE-2018-7749 impacts the affected software by allowing a customized SSH client to bypass the authentication step, potentially leading to unauthorized access.
What is the recommended remedy for CVE-2018-7749?
The recommended remedy for CVE-2018-7749 is to update to version 1.12.1 of the AsyncSSH package.
Where can I find more information about CVE-2018-7749?
More information about CVE-2018-7749 can be found at the following references: [Link 1](https://nvd.nist.gov/vuln/detail/CVE-2018-7749), [Link 2](https://github.com/ronf/asyncssh/commit/c161e26cdc0d41b745b63d9f17b437f073bf7ba4), [Link 3](https://groups.google.com/forum/#!msg/asyncssh-announce/57_5O7kiHSA/8BXZ_hxHAQAJ).