Ubuntu: USN-5351-1 Moderate: Paramiko Allows Private Key Access

ubuntu

March 28, 2022

Paramiko would allow unintended access to private key files.

Summary

Paramiko would allow unintended access to private key files.

Software Description:

- paramiko: Python SSH2 library

Details:

Jan Schejbal discovered that Paramiko incorrectly handled permissions when

writing private key files. A local attacker could possibly use this issue

to gain access to private keys.

Topics Covered

security advisory access issue ubuntu paramiko python library

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
  python3-paramiko                2.7.2-1ubuntu1.1

Ubuntu 20.04 LTS:
  python3-paramiko                2.6.0-2ubuntu0.1

Ubuntu 18.04 LTS:
  python-paramiko                 2.0.0-1ubuntu1.3
  python3-paramiko                2.0.0-1ubuntu1.3

In general, a standard system update will make all the necessary changes.