diff --git a/backport-support-Match-finall-all-in-ssh-config.patch b/backport-support-Match-finall-all-in-ssh-config.patch
new file mode 100644
index 0000000000000000000000000000000000000000..20c072681141cf01a3e2c11a3832e9d3cd6611e8
--- /dev/null
+++ b/backport-support-Match-finall-all-in-ssh-config.patch
@@ -0,0 +1,39 @@
+From b8f41bd4c86090e1ed3e900c3aa6cc98feb324cf Mon Sep 17 00:00:00 2001
+From: "James Z.M. Gao" <gaozm55@gmail.com>
+Date: Sat, 1 Feb 2025 17:26:38 +0800
+Subject: [PATCH] when parsing config, support "Match final all"
+
+---
+ paramiko/config.py | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+Conflict: NA
+Reference: https://github.com/paramiko/paramiko/pull/2494/commits/b8f41bd4c86090e1ed3e900c3aa6cc98feb324cf
+
+diff --git a/paramiko/config.py b/paramiko/config.py
+index 8ab55c644..382b8a711 100644
+--- a/paramiko/config.py
++++ b/paramiko/config.py
+@@ -541,16 +541,20 @@ def _get_matches(self, match):
+         # better handled here than at lookup time.
+         keywords = [x["type"] for x in matches]
+         if "all" in keywords:
+-            allowable = ("all", "canonical")
++            allowable = ("all", "canonical", "final")
+             ok, bad = (
+                 list(filter(lambda x: x in allowable, keywords)),
+                 list(filter(lambda x: x not in allowable, keywords)),
+             )
+             err = None
+             if any(bad):
+-                err = "Match does not allow 'all' mixed with anything but 'canonical'"  # noqa
++                err = "Match does not allow 'all' mixed with anything but 'canonical' or 'final'"  # noqa
++            elif len(ok) > 2:
++                err = "The 'all' Match criteria must appear alone or immediately after 'canonical' or 'final'"  # noqa
+             elif "canonical" in ok and ok.index("canonical") > ok.index("all"):
+                 err = "Match does not allow 'all' before 'canonical'"
++            elif "final" in ok and ok.index("final") > ok.index("all"):
++                err = "Match does not allow 'all' before 'final'"
+             if err is not None:
+                 raise ConfigParseError(err)
+         return matches
diff --git a/python-paramiko.spec b/python-paramiko.spec
index 6bc74cebd805e00c629330434003a6541baa58af..26ea7c40a4b25c3023b4e51bc8281a873d8eb95b 100644
--- a/python-paramiko.spec
+++ b/python-paramiko.spec
@@ -1,12 +1,13 @@
 Name:          python-paramiko
 Version:       3.4.0
-Release:       2
+Release:       3
 Summary:       Python SSH module
 License:       LGPLv2+
 URL:           https://github.com/paramiko/paramiko
 Source0:       https://github.com/paramiko/paramiko/archive/%{version}/paramiko-%{version}.tar.gz
 
 Patch0:        Remove-icecream-dep.patch
+Patch6000:     backport-support-Match-finall-all-in-ssh-config.patch
 Patch9000:     add-insecure-algorithm-log.patch
 
 BuildArch:     noarch
@@ -67,6 +68,9 @@ PYTHONPATH=%{buildroot}%{python3_sitelib} pytest-%{python3_version}
 %doc html/ demos/ README.rst
 
 %changelog
+* Mon Jun 23 2025 zhangpan <zhangpan103@h-partners.com> - 3.4.0-3
+- fix the exception that is thrown when python is used to invoke fabric Config()
+
 * Tue Jun 25 2024 zhangpan <zhangpan103@h-partners.com> - 3.4.0-2
 - add insecure algorithm log