CVE-2018-7749
AsyncSSH SSH Server Authentication Bypass
The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
- Record
CVE-2018-7749- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
- Record
CVE-2018-7749- Updated
- 2026-11-02
EUVDEUVD-2018-0022 No score
The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
- Record
EUVD-2018-0022- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-97cv-6pjf-5f9q
AsyncSSH SSH Server Authentication Bypass
The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
- Record
GHSA-97cv-6pjf-5f9q- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
- Record
CVE-2018-7749- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-7749
The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
- Record
DEBIAN-CVE-2018-7749- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-97cv-6pjf-5f9q
AsyncSSH SSH Server Authentication Bypass
The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
- Record
GHSA-97cv-6pjf-5f9q- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-7749
The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
- Record
UBUNTU-CVE-2018-7749- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVPYSEC-2018-108 No score
The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
- Record
PYSEC-2018-108- Updated
- 2026-11-02
OSVUSN-4854-1 No score
python-asyncssh vulnerability
Matthijs Kooijman discovered that AsyncSSH server did not properly handle authentication under certain conditions. An attacker with a specially crafted client could use this vulnerability to skip authentication of SSH sessions.
- Record
USN-4854-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
asyncsshPyPI |
before 1.12.1 | 1.12.1 |
python-asyncsshDebian:12 |
before 1.12.1-1 | 1.12.1-1 |
python-asyncsshDebian:13 |
before 1.12.1-1 | 1.12.1-1 |
python-asyncsshDebian:14 |
before 1.12.1-1 | 1.12.1-1 |
asyncsshPyPI |
before 1.12.1, plus listed versions 0.8.10.8.20.8.30.8.40.9.0 Show 34 moreShow less0.9.10.9.21.0.01.0.11.1.01.1.11.10.01.10.11.11.01.11.11.12.01.2.01.2.11.3.01.3.11.3.21.4.01.4.11.5.01.5.11.5.21.5.31.5.41.5.51.5.61.6.01.6.11.6.21.7.11.7.21.7.31.8.01.8.11.9.0 |
1.12.1 |
asyncsshPyPI |
before 1.12.1, plus listed versions 0.8.10.8.20.8.30.8.40.9.0 Show 45 moreShow less0.9.10.9.21.0.01.0.11.1.01.1.11.10.01.10.11.11.01.11.11.12.01.2.01.2.11.3.01.3.11.3.21.4.01.4.11.5.01.5.11.5.21.5.31.5.41.5.51.5.61.6.01.6.11.6.21.7.11.7.21.7.31.8.01.8.11.9.0v1.12.0v1.11.1v1.11.0v1.10.1v1.10.0v1.9.0v1.8.1v1.8.0v1.7.3v1.7.2v1.7.1 |
1.12.1 |
python-asyncsshUbuntu:16.04:LTS |
All versions, plus listed versions 1.2.0-11.2.1-11.3.0-1 |
None known |
python-asyncsshUbuntu:Pro:18.04:LTS |
before 1.11.1-1ubuntu0.1~esm1, plus listed versions 1.8.1-21.11.0-21.11.1-1 |
1.11.1-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-7749 is a critical vulnerability (CVSS 9.8) in Asyncssh Project Asyncssh, published March 12, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.78%, the 78th percentile. Fixed in asyncssh 1.12.1.
References
groups.google.com/forum
github.com/ronf/asyncssh/commit/c161e26cdc0d41b745b63d9f17b437f073bf7ba4
nvd.nist.gov/vuln/detail/CVE-2018-7749
Left out here: 36 versions. The JSON record has them.