[ubuntu/artful-security] paramiko 2.0.0-1ubuntu0.1 (Accepted)

[Steve Beattie]

paramiko (2.0.0-1ubuntu0.1) artful-security; urgency=medium

  [Steve Beattie]
  * SECURITY UPDATE: customized clients can skip auth
    - 0004-Fixes-CVE-2018-7750-1175.patch: send message failure if not
      authenticated and message type is a service request
    - 0002-Allow-overriding-test-client-connect-kwargs-in-Trans.patch,
      0003-Initial-tests-proving-CVE-2018-7750-1175.patch:
      add testcases plus prereq
    - CVE-2018-7750

  [ Fabien Tassin ]
  * SECURITY UPDATE: weak diffie-hellman-group1-sha1 kex always preferred (LP: #1728607)
    - 0010-git-c1233679c44-change-order-of-preferred-kex-and-hmac-algorithms.patch
    - 0011-git-b395444062e-Reorder-cipher-and-key-preferences-to-make-more-sense.patch
    Backport of the upstream changes from 2.3.1, matching the OpenSSH 7
    deprecation of diffie-hellman-group1-sha1 (http://www.openssh.com/legacy.html).
    This patch doesn't remove the support of diffie-hellman-group1-sha1 but
    makes it the least preferred kex for backward compatibility

Date: 2018-03-17 06:31:13.857501+00:00
Changed-By: Steve Beattie <sbeattie at ubuntu.com>
https://launchpad.net/ubuntu/+source/paramiko/2.0.0-1ubuntu0.1
-------------- next part --------------
Sorry, changesfile not available.