Notification time stamped 2021-11-29 09:24:37 UTC
From e64d28c37b9f34106860a33a978c706053bc485d Mon Sep 17 00:00:00 2001
From: Paul Howarth <paul(a)city-fan.org>
Date: Nov 29 2021 09:22:51 +0000
Subject: Update to 2.8.1
- New upstream release 2.8.1
- Fix listdir failure when server uses a locale (GH#985, GH#992); now on
Python 2.7 SFTPAttributes will decode abbreviated month names correctly
rather than raise 'UnicodeDecodeError'
- Deleting items from '~paramiko.hostkeys.HostKeys' would incorrectly raise
'KeyError' even for valid keys, due to a logic bug (GH#1024)
- Update RSA and ECDSA key decoding subroutines to correctly catch exception
types thrown by modern versions of Cryptography (specifically 'TypeError'
and its internal 'UnsupportedAlgorithm') (GH#1257, GH#1266); these
exception classes will now become '~paramiko.ssh_exception.SSHException'
instances instead of bubbling up
- Update '~paramiko.pkey.PKey' and subclasses to compare ('__eq__') via
direct field/attribute comparison instead of hashing (while retaining the
existing behavior of '__hash__' via a slight refactor) (GH#908)
Warning:
This fixes a security flaw! If you are running Paramiko on 32-bit systems
with low entropy (such as any 32-bit Python 2, or a 32-bit Python 3 that is
running with 'PYTHONHASHSEED=0') it is possible for an attacker to craft a
new keypair from an exfiltrated public key, which Paramiko would consider
equal to the original key.
This could enable attacks such as, but not limited to, the following:
- Paramiko server processes would incorrectly authenticate the attacker
(using their generated private key) as if they were the victim. We see
this as the most plausible attack using this flaw.
- Paramiko client processes would incorrectly validate a connected server
(when host key verification is enabled) while subjected to a
man-in-the-middle attack. This impacts more users than the server-side
version, but also carries higher requirements for the attacker, namely
successful DNS poisoning or other MITM techniques.
---
diff --git a/.gitignore b/.gitignore
index 30e3e02..83d6262 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,3 +35,4 @@
/paramiko-2.7.1.tar.gz
/paramiko-2.7.2.tar.gz
/paramiko-2.8.0.tar.gz
+/paramiko-2.8.1.tar.gz
diff --git a/python-paramiko.spec b/python-paramiko.spec
index f7cbfe0..b0d0784 100644
--- a/python-paramiko.spec
+++ b/python-paramiko.spec
@@ -1,7 +1,7 @@
%global srcname paramiko
Name: python-%{srcname}
-Version: 2.8.0
+Version: 2.8.1
Release: 1%{?dist}
Summary: SSH2 protocol library for python
@@ -88,6 +88,37 @@ PYTHONPATH=%{buildroot}%{python3_sitelib} pytest-%{python3_version}
%doc html/ demos/
%changelog
+* Mon Nov 29 2021 Paul Howarth <paul(a)city-fan.org> - 2.8.1-1
+- Update to 2.8.1
+ - Fix listdir failure when server uses a locale (GH#985, GH#992); now on
+ Python 2.7 SFTPAttributes will decode abbreviated month names correctly
+ rather than raise 'UnicodeDecodeError'
+ - Deleting items from '~paramiko.hostkeys.HostKeys' would incorrectly raise
+ 'KeyError' even for valid keys, due to a logic bug (GH#1024)
+ - Update RSA and ECDSA key decoding subroutines to correctly catch exception
+ types thrown by modern versions of Cryptography (specifically 'TypeError'
+ and its internal 'UnsupportedAlgorithm') (GH#1257, GH#1266); these
+ exception classes will now become '~paramiko.ssh_exception.SSHException'
+ instances instead of bubbling up
+ - Update '~paramiko.pkey.PKey' and subclasses to compare ('__eq__')
via
+ direct field/attribute comparison instead of hashing (while retaining the
+ existing behavior of '__hash__' via a slight refactor) (GH#908)
+ Warning:
+ This fixes a security flaw! If you are running Paramiko on 32-bit systems
+ with low entropy (such as any 32-bit Python 2, or a 32-bit Python 3 that is
+ running with 'PYTHONHASHSEED=0') it is possible for an attacker to craft a
+ new keypair from an exfiltrated public key, which Paramiko would consider
+ equal to the original key.
+ This could enable attacks such as, but not limited to, the following:
+ - Paramiko server processes would incorrectly authenticate the attacker
+ (using their generated private key) as if they were the victim. We see
+ this as the most plausible attack using this flaw.
+ - Paramiko client processes would incorrectly validate a connected server
+ (when host key verification is enabled) while subjected to a
+ man-in-the-middle attack. This impacts more users than the server-side
+ version, but also carries higher requirements for the attacker, namely
+ successful DNS poisoning or other MITM techniques.
+
* Mon Oct 11 2021 Paul Howarth <paul(a)city-fan.org> - 2.8.0-1
- Update to 2.8.0
- Administrivia overhaul, including but not limited to:
diff --git a/sources b/sources
index 2cc0468..860bc42 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (paramiko-2.8.0.tar.gz) =
15f6e1cab9afdf3285804ce09b3af6c20ffc1f8e50d2549272f0ea545d1fdc858e72c7cba085db85c69aad2033655ae2f025e8ed2bd0dff574bcc03156bdb6ed
+SHA512 (paramiko-2.8.1.tar.gz) =
f48bc1cb880726b4ad6eb982356ead1ae55e2530841736438614b450c7921d0d1b2861a1b6dd8677f5d2d3077231ad1a63b2febc9400a5cf446e487899fc66ac
https://src.fedoraproject.org/rpms/python-paramiko/c/e64d28c37b9f34106860...