Paramiko vulnerability

2024-01-2500:00:00

ubuntu.com

ubuntu

paramiko

ssh

vulnerability

prefix truncation

attack

extension negotiation

terrapin

protocol extensions

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

6.6 Medium

AI Score

Confidence

High

0.963 High

EPSS

Percentile

99.5%

JSON

Releases

Ubuntu 23.10
Ubuntu 22.04 LTS
Ubuntu 20.04 LTS

Packages

paramiko - Python SSH2 library

Details

Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH
protocol was vulnerable to a prefix truncation attack. If a remote attacker
was able to intercept SSH communications, extension negotiation messages
could be truncated, possibly leading to certain algorithms and features
being downgraded. This issue is known as the Terrapin attack. This update
adds protocol extensions to mitigate this issue.

OSVersionArchitecturePackageVersionFilename
Ubuntu23.10noarchpython3-paramiko< 2.12.0-2ubuntu1.23.10.2UNKNOWN
Ubuntu23.10noarchparamiko-doc< 2.12.0-2ubuntu1.23.10.2UNKNOWN
Ubuntu22.04noarchpython3-paramiko< 2.9.3-0ubuntu1.2UNKNOWN
Ubuntu22.04noarchparamiko-doc< 2.9.3-0ubuntu1.2UNKNOWN
Ubuntu20.04noarchpython3-paramiko< 2.6.0-2ubuntu0.3UNKNOWN
Ubuntu20.04noarchparamiko-doc< 2.6.0-2ubuntu0.3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	23.10	noarch	python3-paramiko	< 2.12.0-2ubuntu1.23.10.2	UNKNOWN
Ubuntu	23.10	noarch	paramiko-doc	< 2.12.0-2ubuntu1.23.10.2	UNKNOWN
Ubuntu	22.04	noarch	python3-paramiko	< 2.9.3-0ubuntu1.2	UNKNOWN
Ubuntu	22.04	noarch	paramiko-doc	< 2.9.3-0ubuntu1.2	UNKNOWN
Ubuntu	20.04	noarch	python3-paramiko	< 2.6.0-2ubuntu0.3	UNKNOWN
Ubuntu	20.04	noarch	paramiko-doc	< 2.6.0-2ubuntu0.3	UNKNOWN