[Bug 1728607] Re: weak preferred kex in 16.04 LTS

[Seth Arnold]

I'm not sure if this should be an SRU or a security sponsored update; it
feels like a good idea either way, though.

Thanks

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to paramiko in Ubuntu.
https://bugs.launchpad.net/bugs/1728607

Title:
  weak preferred kex in 16.04 LTS

Status in paramiko package in Ubuntu:
  New

Bug description:
  Paramiko 1.* uses diffie-hellman-group1-sha1 as its most preferred
  kex, but this kex is now considered weak. OpenSSH 7 dropped it from
  its defaults in 2015. Some devices start to complain or even to reject
  connections because of that (I'm experiencing it with routers and
  firewalls)

  This has been fixed upstream in paramiko 2.3.1:
  https://github.com/paramiko/paramiko/commit/c1233679c448b445ec991710d259eec0a9f64b61

  It would be nice to land that in the lastest LTS, probably as a security update.
  It shouldn't have any impact, as long as diffie-hellman-group1-sha1 remains in this list.

  (maybe
  https://github.com/paramiko/paramiko/commit/b395444062e82953d417a4da9157667c2e05d758
  should be considered too)

  Thoughts?

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/paramiko/+bug/1728607/+subscriptions