This bug was fixed in the package paramiko - 2.0.0-1ubuntu0.1 --------------- paramiko (2.0.0-1ubuntu0.1) artful-security; urgency=medium
[Steve Beattie] * SECURITY UPDATE: customized clients can skip auth - 0004-Fixes-CVE-2018-7750-1175.patch: send message failure if not authenticated and message type is a service request - 0002-Allow-overriding-test-client-connect-kwargs-in-Trans.patch, 0003-Initial-tests-proving-CVE-2018-7750-1175.patch: add testcases plus prereq - CVE-2018-7750 [ Fabien Tassin ] * SECURITY UPDATE: weak diffie-hellman-group1-sha1 kex always preferred (LP: #1728607) - 0010-git-c1233679c44-change-order-of-preferred-kex-and-hmac-algorithms.patch - 0011-git-b395444062e-Reorder-cipher-and-key-preferences-to-make-more-sense.patch Backport of the upstream changes from 2.3.1, matching the OpenSSH 7 deprecation of diffie-hellman-group1-sha1 (http://www.openssh.com/legacy.html). This patch doesn't remove the support of diffie-hellman-group1-sha1 but makes it the least preferred kex for backward compatibility -- Steve Beattie <sbeat...@ubuntu.com> Fri, 16 Mar 2018 15:44:26 -0700 ** Changed in: paramiko (Ubuntu) Status: New => Fix Released ** Changed in: paramiko (Ubuntu) Status: New => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1728607 Title: weak preferred kex in 16.04 LTS To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/paramiko/+bug/1728607/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs