CVE-2018-10933

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

Published: Oct 17, 2018
Updated: Apr 13, 2023
CVE: CVE-2018-10933
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.1
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v2:

Severity: Medium
Score: 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:N

CWEs:

CWE-287

OWASP TOP 10:

A2 - Broken Authentication

Affected Software
References

Software	From	Fixed in
libssh / libssh	0.8.0	0.8.4
libssh / libssh	0.6.0	0.7.6
canonical / ubuntu_linux	16.04	16.04.x
canonical / ubuntu_linux	14.04	14.04.x
canonical / ubuntu_linux	18.04	18.04.x
canonical / ubuntu_linux	18.10	18.10.x
debian / debian_linux	8.0	8.0.x
debian / debian_linux	9.0	9.0.x
redhat / enterprise_linux	7.0	7.0.x
netapp / oncommand_unified_manager	7.3	7.3.x
netapp / oncommand_unified_manager	9.4	9.4.x
oracle / mysql_workbench	-	8.0.13.x

http://www.securityfocus.com/bid/105677
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10933
https://lists.debian.org/debian-lts-announce/2018/10/msg00010.html
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0016
https://security.netapp.com/advisory/ntap-20190118-0002/
https://usn.ubuntu.com/3795-1/
https://usn.ubuntu.com/3795-2/
https://www.debian.org/security/2018/dsa-4322
https://www.exploit-db.com/exploits/45638/
https://www.libssh.org/security/advisories/CVE-2018-10933.txt
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Vulnerability Database

CVE-2018-10933

Deep Security Visibility Without the Complexity