Impact
CVE-2018-7750 is a critical authentication-boundary advisory for the Paramiko Python package when Paramiko is used to implement SSH server functionality [S1][S2]. Public advisory data lists affected releases across multiple maintenance branches: before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.0, with patched releases available for those branches [S1][S2].
The advisory applies to applications that build SSH server behavior with Paramiko. In that server-mode context, affected releases did not properly enforce authentication state before later SSH request handling, which can allow unauthenticated access to server-controlled resources depending on how the server is implemented [S1][S2].
Paramiko is also widely used as an SSH client library. A dependency match alone does not prove the repository runs a Paramiko-based SSH server, exposes it to untrusted clients, or is exploitable in production.
Covered by FixVibe
FixVibe's GitHub repo scans flag Python manifests or lockfiles that resolve paramiko in an affected branch range, with the file, version, advisory IDs and fixed version.
Remediation
Upgrade paramiko to a fixed release for the active branch, preferably 2.4.1 or newer when compatible. Regenerate the active Python lockfile, rebuild the deployed virtualenv, container, worker, or host runtime, and rerun the FixVibe repo scan [S1][S2]. If the application implements Paramiko SSH server mode, review ServerInterface and Transport.start_server call paths and keep those endpoints restricted to trusted networks while the rollout completes.