GitHub Advisoryadvisory · PyPI

GHSA-wqmm-q65g-2hqr Paramiko Unsafe randomness usage may allow access to sensitive information

HIGH Published 2022-05-01 Modified 2024-10-08 Official page ↗
Aliases
CVE-2008-0299
Ecosystem
PyPI
Packages
paramiko
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2024-02-09

Affected packages

• PyPI paramiko: < 1.7.1-3 → fixed in 1.7.1-3

Description

common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.

Related

Alias · CVE (1)

  • CVE-2008-0299 common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References