Security update for python-paramiko SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:1850-1 Final 1 1 2018-06-29T12:35:17Z current 2018-06-29T12:35:17Z 2018-06-29T12:35:17Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-paramiko This update for python-paramiko to version 2.0.8 fixes the following issues: - CVE-2018-7750: transport.py in the SSH server implementation of Paramiko did not properly check whether authentication is completed processing other requests. A customized SSH client could have skipped the authentication step (bsc#1085276). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-Storage-5-2018-1248 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20181850-1/ Link for SUSE-SU-2018:1850-1 https://lists.suse.com/pipermail/sle-security-updates/2018-June/004233.html E-Mail link for SUSE-SU-2018:1850-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1085276 SUSE Bug 1085276 https://www.suse.com/security/cve/CVE-2018-7750/ SUSE CVE CVE-2018-7750 page SUSE Enterprise Storage 5 python-paramiko-2.0.8-3.3.1 python-paramiko-2.0.8-3.3.1 as a component of SUSE Enterprise Storage 5 transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step. CVE-2018-7750 SUSE Enterprise Storage 5:python-paramiko-2.0.8-3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181850-1/ https://www.suse.com/security/cve/CVE-2018-7750.html CVE-2018-7750 https://bugzilla.suse.com/1085276 SUSE Bug 1085276 https://bugzilla.suse.com/1111151 SUSE Bug 1111151