[Steve Beattie]
* SECURITY UPDATE: customized clients can skip auth
- 0004-Fixes-CVE-2018-7750-1175.patch: send message failure if not
authenticated and message type is a service request
- 0002-Allow-overriding-test-client-connect-kwargs-in-Trans.patch,
0003-Initial-tests-proving-CVE-2018-7750-1175.patch:
add testcases plus prereq
- CVE-2018-7750
[ Fabien Tassin ]
* SECURITY UPDATE: weak diffie-hellman-group1-sha1 kex always preferred (LP: #1728607)
- 0010-git-c1233679c44-change-order-of-preferred-kex-and-hmac-algorithms.patch
- 0011-git-b395444062e-Reorder-cipher-and-key-preferences-to-make-more-sense.patch
Backport of the upstream changes from 2.3.1, matching the OpenSSH 7
deprecation of diffie-hellman-group1-sha1 (http://www.openssh.com/legacy.html).
This patch doesn't remove the support of diffie-hellman-group1-sha1 but
makes it the least preferred kex for backward compatibility
-- Steve Beattie <email address hidden> Thu, 15 Mar 2018 14:23:22 -0700
This bug was fixed in the package paramiko - 1.16.0-1ubuntu0.1
---------------
paramiko (1.16.0-1ubuntu0.1) xenial-security; urgency=medium
[Steve Beattie] CVE-2018- 7750-1175. patch: send message failure if not overriding- test-client- connect- kwargs- in-Trans. patch, Initial- tests-proving- CVE-2018- 7750-1175. patch:
* SECURITY UPDATE: customized clients can skip auth
- 0004-Fixes-
authenticated and message type is a service request
- 0002-Allow-
0003-
add testcases plus prereq
- CVE-2018-7750
[ Fabien Tassin ] hellman- group1- sha1 kex always preferred (LP: #1728607) c1233679c44- change- order-of- preferred- kex-and- hmac-algorithms .patch b395444062e- Reorder- cipher- and-key- preferences- to-make- more-sense. patch hellman- group1- sha1 (http:// www.openssh. com/legacy. html). hellman- group1- sha1 but
* SECURITY UPDATE: weak diffie-
- 0010-git-
- 0011-git-
Backport of the upstream changes from 2.3.1, matching the OpenSSH 7
deprecation of diffie-
This patch doesn't remove the support of diffie-
makes it the least preferred kex for backward compatibility
-- Steve Beattie <email address hidden> Thu, 15 Mar 2018 14:23:22 -0700