Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 564
Alerts This Week
Warning Icon 1 564

Ubuntu: 3603-1 Critical: Paramiko Remote Execution Threat

ubuntu
Calendar Grey March 20, 2018
Scroller Ubuntu
=========================================================================Ubuntu Security Notice USN-
Paramiko could be made to run programs if it received speciallycrafted network traffic.

Summary

Paramiko could be made to run programs if it received specially

crafted network traffic.

Software Description:

- paramiko: Python SSH2 library

Details:

Matthijs Kooijman discovered that Paramiko's SSH server implementation

did not properly require authentication before processing requests. An

unauthenticated remote attacker could possibly use this to execute

arbitrary code.

Topics%20covered

Topics Covered

security advisory critical remote code execution network traffic ubuntu paramiko

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.10:
  python-paramiko                 2.0.0-1ubuntu0.1
  python3-paramiko                2.0.0-1ubuntu0.1

Ubuntu 16.04 LTS:
  python-paramiko                 1.16.0-1ubuntu0.1
  python3-paramiko                1.16.0-1ubuntu0.1

Ubuntu 14.04 LTS:
  python-paramiko                 1.10.1-1git1ubuntu0.1

After a standard system update you need to restart any applications
using Paramiko's server implementation to make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-3603-1

CVE-2018-7750

Severity
critical
Lowest
Low
Medium
High
Critical

March 20, 2018

Topics%20covered

Topics Covered

security advisory critical remote code execution network traffic ubuntu paramiko

Package Information

https://launchpad.net/ubuntu/+source/paramiko/2.0.0-1ubuntu0.1
https://launchpad.net/ubuntu/+source/paramiko/1.16.0-1ubuntu0.1
https://launchpad.net/ubuntu/+source/paramiko/1.10.1-1git1ubuntu0.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.