Security update for python-paramiko SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0873-1 Final 1 1 2018-04-04T10:19:15Z current 2018-04-04T10:19:15Z 2018-04-04T10:19:15Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-paramiko This update for python-paramiko fixes the following issues: - CVE-2018-7750: Fixed transport.py in the SSH server implementation of Paramiko that does not properly check whether authentication is completed before processing other requests (bsc#1085276). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-6-2018-588,SUSE-Storage-3-2018-588 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180873-1/ Link for SUSE-SU-2018:0873-1 https://lists.opensuse.org/opensuse-security-announce/2018-04/msg00003.html E-Mail link for SUSE-SU-2018:0873-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1085276 SUSE Bug 1085276 https://www.suse.com/security/cve/CVE-2018-7750/ SUSE CVE CVE-2018-7750 page SUSE Enterprise Storage 3 SUSE OpenStack Cloud 6 python-paramiko-1.15.2-2.6.1 python-paramiko-1.15.2-2.6.1 as a component of SUSE Enterprise Storage 3 python-paramiko-1.15.2-2.6.1 as a component of SUSE OpenStack Cloud 6 transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step. CVE-2018-7750 SUSE Enterprise Storage 3:python-paramiko-1.15.2-2.6.1 SUSE OpenStack Cloud 6:python-paramiko-1.15.2-2.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180873-1/ https://www.suse.com/security/cve/CVE-2018-7750.html CVE-2018-7750 https://bugzilla.suse.com/1085276 SUSE Bug 1085276 https://bugzilla.suse.com/1111151 SUSE Bug 1111151