sadpandajoe commented on code in PR #45709: URL: https://github.com/apache/superset/pull/45709#discussion_r4430782670
########## UPDATING.md: ########## @@ -2647,6 +2647,10 @@ Charts and dashboards using these anchors will compute a different (correct) tim list that explicitly contains NULL still excludes NULL rows. `!=`, `NOT LIKE` and `NOT ILIKE` are unchanged. +### `paramiko` upgraded to v5 + +`paramiko` has been upgraded to v5 with several breaking changes in terms of security hardening. Please upgrade your system to support SHA256/SHA512 Diff-Hellman key-exchange algorithm and SHA2-based signature with RSA keys. Review Comment: A bastion that supports RSA-SHA2 and SHA-256 key exchange still fails to connect if its only `diffie-hellman-group-exchange-sha256` offer has a maximum modulus under 2048 bits, because paramiko 5 raised that minimum from 1024. The note as written (SHA-256/SHA-512 DH plus SHA-2 RSA signatures) would lead an operator to think enabling those is enough. Could the note also mention the 2048-bit group-exchange minimum on the SSH server side? Also a small typo: "Diff-Hellman" should be "Diffie-Hellman". -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
