ALAS-2018-1096


Amazon Linux AMI Security Advisory: ALAS-2018-1096
Advisory Release Date: 2018-10-23 23:57 Pacific
Severity: Critical
References: CVE-2018-1000805 

Issue Overview:

Paramiko contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity. This issue does not affect instances where only the ssh client functionality of the paramiko library is used.(CVE-2018-1000805 )


Affected Packages:

python-paramiko


Issue Correction:
Run yum update python-paramiko to update your system.

New Packages:
noarch:
    python27-paramiko-1.15.1-2.7.amzn1.noarch
    python26-paramiko-1.15.1-2.7.amzn1.noarch

src:
    python-paramiko-1.15.1-2.7.amzn1.src