Veille CVE

Recherche « Paramiko »

4 CVE

Critique 0 Élevée 1 Moyenne 2 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Paramiko » ✕
  1. CVE-2026-93858 8.7 Élevée

    OpenStack Mistral

    In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH connection to a gateway or target host is attempted. An authenticated project member can use the standard action-execution API to submit an arbitrary local command as proxy_command; paramiko starts that command as a subprocess on the executor host under the executor's own service account, independent of whether the SSH connection itself ever succeeds. Only Mistral deployments that permit the std.ssh_proxied action, the default configuration, are affected.

  2. CVE-2026-93966 4.7 Moyenne

    aiyiyi121 SxDevOps

    A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SSHClient.exec_command of the file backend/ops/host_tasks.py of the component TASK_RUN_COMMAND. Such manipulation of the argument command leads to command injection. The attack may be launched remotely. The name of the patch is 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is advisable to implement a patch to correct this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

  3. CVE-2026-38974 5.3 Moyenne

    Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.

  4. CVE-2026-44405 3.4 Faible

    Paramiko

    In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.