Bug 1605568 - Python Paramiko has an outdated/insecure version in EPEL Repo, even after update
Summary: Python Paramiko has an outdated/insecure version in EPEL Repo, even after update
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: python-paramiko
Version: epel7
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
Assignee: Othman Madjoudj
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-07-20 16:02 UTC by ryan.baker
Modified: 2018-07-21 07:58 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-07-21 07:58:08 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description ryan.baker 2018-07-20 16:02:49 UTC
Description of problem:
There was a security bulletin released from redhat ( https://www.redhat.com/archives/rhsa-announce/2018-March/msg00051.html ) a few months ago mentioning that python-paramiko has been updated to python-paramiko-2.1.1-4.el7.src.rpm to address a security concern. However, in the repo it looks like it is still on the old version. What is interesting though, is that the last updated date is the same date as the security bulletin. It appears that it was updated to the same version it already was

Version-Release number of selected component (if applicable):
n/a

How reproducible:
By updating with yum or by viewing the packages in epel directly

Steps to Reproduce:
1. Go to here https://dl.fedoraproject.org/pub/epel/7/x86_64/Packages/p/
2. search for python-paramiko

Actual results:
The version is python-paramiko-2.1.1-0.4.el7.noarch.rpm (with updated date of 2018-03-26)

Expected results:
The version should be python-paramiko-2.1.1-4.el7.src.rpm

Additional info:

Comment 1 Paul Howarth 2018-07-21 07:57:10 UTC
python-paramiko-2.1.1-0.4.el7 from EPEL is the same as python-paramiko-2.1.1-4.el7 from CentOS or RHEL. It has a "0." prepended to the release number so as to ensure that users that can receive the package directly from their OS provider get the OS provider's package rather than the EPEL package, since EPEL packages are not allowed to replace OS packages. So everything is working as intended here.


Note You need to log in before you can comment on or make changes to this bug.