CVE-2018-10933
Fixed in a distro release EPSS 92%CVSS 9.1
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.
Products: libssh, canonical ubuntu_linux, debian_linux, redhat enterprise_linux, netapp oncommand_unified_manager, netapp oncommand_workflow_automation, netapp snapcenter, netapp storage_automation_store, oracle mysql_workbench
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | libssh | 0.7.6-r0 |
| Alpine 3.11 | libssh | 0.7.6-r0 |
| Alpine 3.5 | libssh | 0.7.6-r0 |
| Alpine 3.6 | libssh | 0.7.6-r0 |
| Alpine 3.7 | libssh | 0.7.6-r0 |
| Alpine 3.8 | libssh | 0.7.6-r0 |
| Alpine 3.9 | libssh | 0.7.6-r0 |
| Arch Linux | libssh | 0.8.4-1 |
| Debian 12 | libssh | 0.8.4-1 |
| Debian 13 | libssh | 0.8.4-1 |
| Debian 14 | libssh | 0.8.4-1 |
| Debian 8 | libssh | 0.6.3-4+deb8u3 |
| Debian 9 | libssh | 0.7.3-2+deb9u1 |
| Red Hat rhel extras other 7 | cockpit | 0:176-4.el7 |
| Red Hat rhel extras other 7 | cockpit-dashboard | 0:176-4.el7 |
| Red Hat rhel extras other 7 | cockpit-docker | 0:176-4.el7 |
| Red Hat rhel extras other 7 | cockpit-machines | 0:176-4.el7 |
| Red Hat rhel extras other 7 | cockpit-packagekit | 0:176-4.el7 |
| Red Hat rhel extras other 7 | cockpit-pcp | 0:176-4.el7 |
| Red Hat rhel extras other 7 | cockpit-storaged | 0:176-4.el7 |
| Red Hat rhel extras other 7 | libssh | 0:0.7.1-7.el7 |
| Red Hat rhel extras other 7 | libssh-debuginfo | 0:0.7.1-7.el7 |
| Red Hat rhel extras other 7 | libssh-devel | 0:0.7.1-7.el7 |
| SUSE Linux Enterprise Desktop 12 SP3 | libssh | 0.6.3-12.6.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | libssh | 0.7.5-6.3.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | libssh | 0.6.3-12.6.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP3 | libssh | 0.6.3-12.6.1 |
| Ubuntu 14.04 LTS | libssh | 0.6.1-0ubuntu3.4 |
| Ubuntu 16.04 LTS | libssh | 0.6.3-4.3ubuntu0.1 |
| Ubuntu 18.04 LTS | libssh | 0.8.0~20170825.94fa1e38-1ubuntu0.1 |
| openSUSE Tumbleweed | libssh | 0.9.6-1.2 |