python-paramiko 1.16.0-1 incompatible with python-crypto 2.6.1-6ubuntu0.16.04.1

[Kenneth Henderick]

Since python-crypto 2.6.1-6ubuntu0.16.04.1 landed, it seems python-paramiko 1.16.0-1 is not working anymore.

/usr/lib/python2.7/dist-packages/paramiko/client.pyc in connect(self, hostname, port, username, password, pkey, key_filename, timeout, allow_agent, look_for_keys, compress, sock, gss_auth, gss_kex, gss_deleg_creds, gss_host, banner_timeout)
    323 if banner_timeout is not None:
    324 t.banner_timeout = banner_timeout
--> 325 t.start_client()
    326 ResourceManager.register(self, t)
    327

/usr/lib/python2.7/dist-packages/paramiko/transport.pyc in start_client(self, event)
    490 e = self.get_exception()
    491 if e is not None:
--> 492 raise e
    493 raise SSHException('Negotiation failed.')
    494 if event.is_set():

ValueError: CTR mode needs counter parameter, not IV

Seems related to the fix for CVE-2013-7459

Extra information:

root@kh001:~# lsb_release -rd
Description: Ubuntu 16.04.1 LTS
Release: 16.04

root@kh001:~# apt-cache policy python-paramiko
python-paramiko:
  Installed: 1.16.0-1
  Candidate: 1.16.0-1
  Version table:
 *** 1.16.0-1 500
        500 http://be.archive.ubuntu.com/ubuntu xenial/main amd64 Packages
        500 http://be.archive.ubuntu.com/ubuntu xenial/main i386 Packages
        100 /var/lib/dpkg/status

root@kh001:~# apt-cache policy python-crypto
python-crypto:
  Installed: 2.6.1-6ubuntu0.16.04.1
  Candidate: 2.6.1-6ubuntu0.16.04.1
  Version table:
 *** 2.6.1-6ubuntu0.16.04.1 500
        500 http://be.archive.ubuntu.com/ubuntu xenial-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu xenial-security/main amd64 Packages
        100 /var/lib/dpkg/status
     2.6.1-6build1 500
        500 http://be.archive.ubuntu.com/ubuntu xenial/main amd64 Packages

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[James Page (james-page)]

Ubuntu OpenStack CI is tripping over this which is causing quite alot of issues in our pre-landing tests in the OpenStack charms.

[Spandex (spandex)]

Also affects 14.04 (python-paramiko 1.10.1-1git1build1)

[Erich E. Hoover (ehoover)]

We applied this patch to get up and running again:
https://github.com/paramiko/paramiko/pull/714/commits/4752287a7379da61245087ee7e35635a4e42bb3f

[Gregory M. Blumenthal Scharf (llameadrpc)]

Patch (#4) works for mysql-workbench 6.3 on xenial. Thanks, ehoover!

[Erich E. Hoover (ehoover)]

deb-aelwyn gets the credit for this one, I'm just the monkey entering info into the bug report ;)

[Adam Jacob Muller (78luphr0rnk2nuqimstywepozxn9kl19tqh0tx66b5dki1xxsh5mkz9gl21a5rlwfnr8jn6ln0m3jxne2k9x1ohg85w3jabxlrqbgszpjpwcmvk-launchpad)]

Can also confirm that that fix works on trusty too, no regressions with a pretty wide set of devices we're connecting to

[Hans Joachim Desserud (hjd)]

With bug 1665598, python-crypto should now print a warning instead of throwing an exception. (This update should be available for 14.04, 16.04 and 16.10 already) Due to the security aspect I assume this is something which should be fixed properly in paramiko, but it doesn't look like it should throw an exception any more.

[Ryan Beisner (1chb1n)]

Confirmed that installing the updated python-crypto 2.6.1-6ubuntu0.16.04.2 unblocks UOSCI.

I was seeing trace:

Traceback (most recent call last):
  File "/usr/lib/python2.7/multiprocessing/process.py", line 258, in _bootstrap
    self.run()
  File "/usr/lib/python2.7/multiprocessing/process.py", line 114, in run
    self._target(*self._args, **self._kwargs)
  File "/home/ubuntu/bzr/ubuntu-openstack-ci-use-port-cleanup-tool/tools/../common/osci_utils.py", line 635, in ssh_command_check
    pkey=pkey_rsa, timeout=timeout)
  File "/usr/lib/python2.7/dist-packages/paramiko/client.py", line 325, in connect
    t.start_client()
  File "/usr/lib/python2.7/dist-packages/paramiko/transport.py", line 492, in start_client
    raise e
ValueError: CTR mode needs counter parameter, not IV

.

Now only receive a warning:

/usr/lib/python2.7/dist-packages/Crypto/Cipher/blockalgo.py:141: FutureWarning: CTR mode needs counter parameter, not IV

[jowan512 (jowan-sebastian)]

Also breaks Fabric used for web deployment. Patch (#4) works in this case.

[Fluwell (fluwell)]

https://github.com/paramiko/paramiko/pull/889 fixed upstream

[Marc Deslauriers (mdeslaur)]

This should be fixed now:
https://www.ubuntu.com/usn/usn-3199-2/

I'm closing this bug. Feel free to re-open it if something is still broken after the regression fix is applied. Thanks.

[Kenneth Henderick (kenneth-w)]

One could argue that there's now a warning which might change the behavior of some software. I would expect that this ticket (at least the part about the python-paramiko package) would only be resolved once paramiko 1.17 would be packaged, replacing current 1.16.