Security update for python-amqp, python-oslo.messaging, python-ovs, python-paramiko, python-psql2mysql SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:0481-1 Final 1 1 2019-02-25T10:56:06Z current 2019-02-25T10:56:06Z 2019-02-25T10:56:06Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-amqp, python-oslo.messaging, python-ovs, python-paramiko, python-psql2mysql This update for python-amqp, python-oslo.messaging, python-ovs, python-paramiko, python-psql2mysql fixes the following issues: Security issue fixed for python-paramiko: - CVE-2018-1000805: Fixed an authentication bypass (bnc#1111151). Non-security issues fixed: - python-oslo.messaging: Fixed an issue if the client tries to reconnect after connection was lost (bsc#1123054). - python-ovs: Fixed memory leak in c parser (bsc#1116437). - python-ovs: Switched away from noarch and build the C based backend (bsc#1115099). - python-psql2mysql: Update to version 0.5.0+git.1539592188.13e5d0f. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-481,SUSE-OpenStack-Cloud-7-2019-481,SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2019-481,SUSE-Storage-4-2019-481 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20190481-1/ Link for SUSE-SU-2019:0481-1 https://lists.suse.com/pipermail/sle-security-updates/2019-February/005151.html E-Mail link for SUSE-SU-2019:0481-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1111151 SUSE Bug 1111151 https://bugzilla.suse.com/1115099 SUSE Bug 1115099 https://bugzilla.suse.com/1116437 SUSE Bug 1116437 https://bugzilla.suse.com/1123054 SUSE Bug 1123054 https://www.suse.com/security/cve/CVE-2018-1000805/ SUSE CVE CVE-2018-1000805 page SUSE Enterprise Storage 4 SUSE OpenStack Cloud 7 python-amqp-1.4.9-3.3.1 python-oslo.messaging-5.10.2-3.9.1 python-oslo.messaging-doc-5.10.2-3.9.1 python-ovs-2.5.0-3.3.1 python-paramiko-2.0.9-3.6.1 python-psql2mysql-0.5.0+git.1539592188.13e5d0f-1.9.1 python-paramiko-2.0.9-3.6.1 as a component of SUSE Enterprise Storage 4 python-amqp-1.4.9-3.3.1 as a component of SUSE OpenStack Cloud 7 python-oslo.messaging-5.10.2-3.9.1 as a component of SUSE OpenStack Cloud 7 python-ovs-2.5.0-3.3.1 as a component of SUSE OpenStack Cloud 7 python-paramiko-2.0.9-3.6.1 as a component of SUSE OpenStack Cloud 7 python-psql2mysql-0.5.0+git.1539592188.13e5d0f-1.9.1 as a component of SUSE OpenStack Cloud 7 Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity. CVE-2018-1000805 SUSE Enterprise Storage 4:python-paramiko-2.0.9-3.6.1 SUSE OpenStack Cloud 7:python-amqp-1.4.9-3.3.1 SUSE OpenStack Cloud 7:python-oslo.messaging-5.10.2-3.9.1 SUSE OpenStack Cloud 7:python-ovs-2.5.0-3.3.1 SUSE OpenStack Cloud 7:python-paramiko-2.0.9-3.6.1 SUSE OpenStack Cloud 7:python-psql2mysql-0.5.0+git.1539592188.13e5d0f-1.9.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190481-1/ https://www.suse.com/security/cve/CVE-2018-1000805.html CVE-2018-1000805 https://bugzilla.suse.com/1111151 SUSE Bug 1111151