paramiko is vulnerable to authentication bypass attacks. The vulnerability exists as the SSH server implementation of paramiko processes requests without waiting for the completion of authentication. This allows attackers to use a customized SSH client that skips authentication and continue its unauthenticated session.
www.securityfocus.com/bid/103713
access.redhat.com/errata/RHSA-2018:0591
access.redhat.com/errata/RHSA-2018:0646
access.redhat.com/errata/RHSA-2018:1124
access.redhat.com/errata/RHSA-2018:1125
access.redhat.com/errata/RHSA-2018:1213
access.redhat.com/errata/RHSA-2018:1274
access.redhat.com/errata/RHSA-2018:1328
access.redhat.com/errata/RHSA-2018:1525
access.redhat.com/errata/RHSA-2018:1972
github.com/paramiko/paramiko/blob/master/sites/www/changelog.rst
github.com/paramiko/paramiko/commit/fa29bd8446c8eab237f5187d28787727b4610516
github.com/paramiko/paramiko/issues/1175
lists.debian.org/debian-lts-announce/2018/10/msg00018.html
lists.debian.org/debian-lts-announce/2021/12/msg00025.html
usn.ubuntu.com/3603-1/
usn.ubuntu.com/3603-2/
www.exploit-db.com/exploits/45712/