CVE-2018-10933
17.10.2018, 12:29
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.Enginsight
| Vendor | Product | Version |
|---|---|---|
| libssh | libssh | 0.6.0 ≤ 𝑥 < 0.7.6 |
| libssh | libssh | 0.8.0 ≤ 𝑥 < 0.8.4 |
| canonical | ubuntu_linux | 14.04 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 18.10 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 9.0 |
| redhat | enterprise_linux | 7.0 |
| netapp | oncommand_unified_manager | 7.3 ≤ |
| netapp | oncommand_unified_manager | 9.4 ≤ |
| netapp | oncommand_workflow_automation | - |
| netapp | snapcenter | - |
| netapp | storage_automation_store | - |
| oracle | mysql_workbench | 𝑥 ≤ 8.0.13 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-592 - DEPRECATED: Authentication Bypass IssuesThis weakness has been deprecated because it covered redundant concepts already described in CWE-287.
- CWE-287 - Improper AuthenticationWhen an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
References