ALAS-2018-1096


Amazon Linux 1 Security Advisory: ALAS-2018-1096
Advisory Release Date: 2018-10-23 18:43 Pacific
Advisory Updated Date: 2018-10-23 23:57 Pacific
Severity: Critical

Issue Overview:

Paramiko contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity. This issue does not affect instances where only the ssh client functionality of the paramiko library is used.(CVE-2018-1000805)


Affected Packages:

python-paramiko


Issue Correction:
Run yum update python-paramiko to update your system.

New Packages:
noarch:
    python27-paramiko-1.15.1-2.7.amzn1.noarch
    python26-paramiko-1.15.1-2.7.amzn1.noarch

src:
    python-paramiko-1.15.1-2.7.amzn1.src