Security Bulletin: Storage Virtualize Ansible Collection is affected by a vulnerability in the paramiko package

Summary

Storage Virtualize Ansible Collection uses the third-party library paramiko to implement SSH for authentication to target systems. Version 3.3.1 of paramiko is vulnerable to CVE-2023-48795.

Vulnerability Details

CVEID:CVE-2023-48795
**DESCRIPTION:**OpenSSH is vulnerable to a machine-in-the-middle attack, caused by a flaw in the extension negotiation process in the SSH transport protocol when used with certain OpenSSH extensions. A remote attacker could exploit this vulnerability to launch a machine-in-the-middle attack and strip an arbitrary number of messages after the initial key exchange, breaking SSH extension negotiation and downgrading the client connection security.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/275282 for the current score.
CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

Update ibm.storage_virtualize to version >= 2.3.0 which includes paramiko 3.4.0.

Alternatively, install paramiko >= 3.4.0 over ibm.storage_virtualize version 2.2.0. The plugin will still work on paramiko < 3.4.0, but it is necessary to update to fix this vulnerability.

Ansible collection ibm.storage_virtualize : <https://github.com/ansible-collections/ibm.storage_virtualize&gt;

Workarounds and Mitigations

None