USN-5351-1: Paramiko vulnerability

Releases

• Ubuntu 21.10
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• paramiko - Python SSH2 library

Details

Jan Schejbal discovered that Paramiko incorrectly handled permissions when
writing private key files. A local attacker could possibly use this issue
to gain access to private keys.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 21.10

• python3-paramiko - 2.7.2-1ubuntu1.1

Ubuntu 20.04

• python3-paramiko - 2.6.0-2ubuntu0.1

Ubuntu 18.04

• python3-paramiko - 2.0.0-1ubuntu1.3
• python-paramiko - 2.0.0-1ubuntu1.3

In general, a standard system update will make all the necessary changes.

References

• CVE-2022-24302

Related notices

• USN-5351-2: paramiko-doc, python-paramiko, python3-paramiko, paramiko