Every CVE Search/ Get API key

CVE-2018-10933

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4....

9.1 CriticalPublic exploitFix available

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

91.8%Up 46.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 9.1

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

Record
CVE-2018-10933
CVSS 3.0
9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-592
Updated
2026-11-02
EUVDEUVD-2018-2986 9.1

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

Record
EUVD-2018-2986
CVSS 3.0
9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-22gf-f5w4-hrfq 9.1

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4....

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

Record
GHSA-22gf-f5w4-hrfq
CVSS 3.0
9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-287
Updated
2026-11-02
NVD 9.1

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

Record
CVE-2018-10933
CVSS 3.0
9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0
6.4 MediumAV:N/AC:L/Au:N/C:P/I:P/A:N
Weakness
CWE-592, CWE-287
Updated
2026-11-02
OSVALPINE-CVE-2018-10933 9.1

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

Record
ALPINE-CVE-2018-10933
CVSS 3.0
9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVBELL-CVE-2018-10933 9.1

CVE-2018-10933 does not affect BellSoft software

Record
BELL-CVE-2018-10933
CVSS 3.0
9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 9 moreShow less
OSV 9.1

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

Record
CVE-2018-10933
CVSS 3.0
9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2018-10933 9.1

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

Record
DEBIAN-CVE-2018-10933
CVSS 3.0
9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHBA-2018:3712 9.1

Red Hat Bug Fix Advisory: cockpit bug fix update

Record
RHBA-2018:3712
CVSS 3.0
9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2018-10933 9.1

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

Record
UBUNTU-CVE-2018-10933
CVSS 3.0
9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVMGASA-2019-0043 No score

Updated libssh packages fix security vulnerability

libssh versions 0.6 and above have an authentication bypass vulnerability in the server code. By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication, the attacker could successfully authentciate without any credentials (CVE-2018-10933).

Record
MGASA-2019-0043
Updated
2026-11-02
OSVopenSUSE-SU-2024:10998-1 No score

libssh-config-0.9.6-1.2 on GA media

These are all security issues fixed in the libssh-config-0.9.6-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10998-1
Updated
2026-11-02
OSVSUSE-SU-2018:3162-1 No score

Security update for libssh

This update for libssh fixes the following issues:

  • CVE-2018-10933: Fixed a server mode authentication bypass (bsc#1108020).
Record
SUSE-SU-2018:3162-1
Updated
2026-11-02
OSVSUSE-SU-2018:3253-1 No score

Security update for libssh

This update for libssh fixes the following issues:

Security issue fixed:

  • CVE-2018-10933: Fixed a server mode authentication bypass (bsc#1108020).

Non security issue fixed:

  • Fix popd syntax to be compatible with newer versions of the bash shell.
Record
SUSE-SU-2018:3253-1
Updated
2026-11-02
OSVUSN-3795-1 No score

libssh vulnerability

Peter Winter-Smith discovered that libssh incorrectly handled authentication when being used as a server. A remote attacker could use this issue to bypass authentication without any credentials.

Record
USN-3795-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libssh
Alpine:v3.10
 0.6.0 up to 0.7.6-r0
0.7.6-r0
libssh
Alpine:v3.11
 0.6.0 up to 0.7.6-r0
0.7.6-r0
libssh
Alpine:v3.5
 0.6.0 up to 0.7.6-r0
0.7.6-r0
libssh
Alpine:v3.6
 0.6.0 up to 0.7.6-r0
0.7.6-r0
libssh
Alpine:v3.7
 0.6.0 up to 0.7.6-r0
0.7.6-r0
libssh
Alpine:v3.8
 0.6.0 up to 0.7.6-r0
0.7.6-r0
libssh
Alpine:v3.9
 0.6.0 up to 0.7.6-r0
0.7.6-r0
libssh
Debian:12
 before 0.8.4-1
0.8.4-1
libssh
Debian:13
 before 0.8.4-1
0.8.4-1
libssh
Debian:14
 before 0.8.4-1
0.8.4-1
Show 21 moreShow less
Affected packages
PackageAffectedFixed
libssh
Debian:8
 before 0.6.3-4+deb8u3, plus listed versions
0.6.3-40.6.3-4+deb8u10.6.3-4+deb8u2
0.6.3-4+deb8u3
libssh
Debian:9
 before 0.7.3-2+deb9u1, plus listed versions
0.7.3-2
0.7.3-2+deb9u1
libssh
Mageia:6
 before 0.7.7-1.mga6
0.7.7-1.mga6
cockpit
Red Hat:rhel_extras_other:7
 before 0:176-4.el7
0:176-4.el7
cockpit-dashboard
Red Hat:rhel_extras_other:7
 before 0:176-4.el7
0:176-4.el7
cockpit-machines
Red Hat:rhel_extras_other:7
 before 0:176-4.el7
0:176-4.el7
cockpit-packagekit
Red Hat:rhel_extras_other:7
 before 0:176-4.el7
0:176-4.el7
cockpit-pcp
Red Hat:rhel_extras_other:7
 before 0:176-4.el7
0:176-4.el7
cockpit-storaged
Red Hat:rhel_extras_other:7
 before 0:176-4.el7
0:176-4.el7
libssh
Red Hat:rhel_extras_other:7
 before 0:0.7.1-7.el7
0:0.7.1-7.el7
libssh-debuginfo
Red Hat:rhel_extras_other:7
 before 0:0.7.1-7.el7
0:0.7.1-7.el7
cockpit-docker
Red Hat:rhel_extras_other:7
 before 0:176-4.el7
0:176-4.el7
libssh-devel
Red Hat:rhel_extras_other:7
 before 0:0.7.1-7.el7
0:0.7.1-7.el7
libssh
SUSE:Linux Enterprise Module for Basesystem 15
 before 0.7.5-6.3.1
0.7.5-6.3.1
libssh
SUSE:Linux Enterprise Desktop 12 SP3
 before 0.6.3-12.6.1
0.6.3-12.6.1
libssh
SUSE:Linux Enterprise Software Development Kit 12 SP3
 before 0.6.3-12.6.1
0.6.3-12.6.1
libssh
SUSE:Linux Enterprise Workstation Extension 12 SP3
 before 0.6.3-12.6.1
0.6.3-12.6.1
libssh
Ubuntu:14.04:LTS
 before 0.6.1-0ubuntu3.4, plus listed versions
0.5.4-10.6.1-0ubuntu20.6.1-0ubuntu30.6.1-0ubuntu3.10.6.1-0ubuntu3.3
0.6.1-0ubuntu3.4
libssh
Ubuntu:16.04:LTS
 before 0.6.3-4.3ubuntu0.1, plus listed versions
0.6.3-3ubuntu30.6.3-4.10.6.3-4.20.6.3-4.2ubuntu10.6.3-4.3
0.6.3-4.3ubuntu0.1
libssh
Ubuntu:18.04:LTS
 before 0.8.0~20170825.94fa1e38-1ubuntu0.1, plus listed versions
0.7.5-10.8.0~20170825.94fa1e38-10.8.0~20170825.94fa1e38-1build1
0.8.0~20170825.94fa1e38-1ubuntu0.1
libssh
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 0.9.6-1.2
0.9.6-1.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubSoledaD208/CVE-2018-109332018-10-17
PoC in GitHubblacknbunny/CVE-2018-109332018-10-17
PoC in GitHubhook-s3c/CVE-2018-109332018-10-17
PoC in GitHubjobroche/libssh-scanner2018-10-17
PoC in GitHubkn6869610/CVE-2018-109332018-10-17
Exploit-DBlibSSH - Authentication Bypass2018-10-18
PoC in GitHubcve-2018/cve-2018-109332018-10-18
PoC in GitHubhackerhouse-opensource/cve-2018-109332018-10-18
PoC in GitHublikekabin/CVE-2018-10933-libSSH-Authentication-Bypass2018-10-18
PoC in GitHublikekabin/CVE-2018-10933_ssh2018-10-18
Show 18 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubmarco-lancini/hunt-for-cve-2018-109332018-10-18
Exploit-DBLibSSH 0.7.6 / 0.8.4 - Unauthorized Access2018-10-20
PoC in GitHubVirgula0/POC-CVE-2018-109332018-10-20
PoC in GitHubjas502n/CVE-2018-109332018-10-20
PoC in GitHubninp0/cve-2018-10933_poc2018-10-20
PoC in GitHubpghook/CVE-2018-10933_Scanner2018-10-20
PoC in GitHubshifa123/pythonprojects-CVE-2018-109332018-10-21
PoC in GitHubxFreed0m/CVE-2018-109332018-10-21
PoC in GitHubBifrozt/CVE-2018-109332018-10-23
PoC in GitHubr3dxpl0it/CVE-2018-109332018-10-23
PoC in GitHubivanacostarubio/libssh-scanner2018-10-24
PoC in GitHubreanimat0r/bpnd-libssh2018-10-24
PoC in GitHubthrowawayaccount12312312/precompiled-CVE-2018-109332018-10-24
PoC in GitHubensimag-security/CVE-2018-109332018-10-25
PoC in GitHub0xadaw/libSSH-bypass2018-11-16
PoC in GitHubsambiyal/CVE-2018-10933-POC2018-11-21
PoC in GitHubnikhil1232/LibSSH-Authentication-Bypass2018-12-19
Metasploitlibssh Authentication Bypass Scanner2018-10-16

Plus 14 more. The full list has every link.

History

History
RecordedChangedSources
affected, facts
exploits, exploits_more
exploits
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-10933 is a critical vulnerability (CVSS 9.1) in [unknown] Libssh, published October 16, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 91.8%, the 99th percentile. Fixed in libssh 0.7.6-r0.

References

Show 31 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open