Security update for python-paramiko SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:2777-1 Final 1 1 2018-09-21T05:52:22Z current 2018-09-21T05:52:22Z 2018-09-21T05:52:22Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-paramiko This update for python-paramiko to version 1.18.5 fixes the following issues: This security issue was fixed: - CVE-2018-7750: transport.py in the SSH server implementation of Paramiko did not properly check whether authentication is completed processing other requests. A customized SSH client could have skipped the authentication step (bsc#1085276) This non-security issue was fixed: - Prevent connection problems with ssh servers due to no acceptable macs being available (bsc#1106148) For additional changes please check the changelog. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Module-Public-Cloud-12-2018-1945 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20182777-1/ Link for SUSE-SU-2018:2777-1 https://lists.suse.com/pipermail/sle-security-updates/2018-September/004573.html E-Mail link for SUSE-SU-2018:2777-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1085276 SUSE Bug 1085276 https://bugzilla.suse.com/1106148 SUSE Bug 1106148 https://www.suse.com/security/cve/CVE-2018-7750/ SUSE CVE CVE-2018-7750 page SUSE Linux Enterprise Module for Public Cloud 12 python-paramiko-1.18.5-2.12.1 python-paramiko-1.18.5-2.12.1 as a component of SUSE Linux Enterprise Module for Public Cloud 12 transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step. CVE-2018-7750 SUSE Linux Enterprise Module for Public Cloud 12:python-paramiko-1.18.5-2.12.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182777-1/ https://www.suse.com/security/cve/CVE-2018-7750.html CVE-2018-7750 https://bugzilla.suse.com/1085276 SUSE Bug 1085276 https://bugzilla.suse.com/1111151 SUSE Bug 1111151