CVE-2008-0299 Paramiko Unsafe randomness usage may allow access to sensitive information
MediumCVSS 4.3
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi paramiko(PyPI) | < 1.7.1-3 | 1.7.1-3 |
| pypi paramiko(PyPI) | = 0.1-bulbasaur | No fix listed |
| pypi paramiko(PyPI) | = 0.1-charmander | No fix listed |
| pypi paramiko(PyPI) | = 0.9-doduo | No fix listed |
| pypi paramiko(PyPI) | = 0.9-eevee | No fix listed |
| pypi paramiko(PyPI) | = 0.9-fearow | No fix listed |
| pypi paramiko(PyPI) | = 0.9-gyarados | No fix listed |
| pypi paramiko(PyPI) | = 0.9-horsea | No fix listed |
| pypi paramiko(PyPI) | = 0.9-ivysaur | No fix listed |
| pypi paramiko(PyPI) | = 1.0 | No fix listed |
| pypi paramiko(PyPI) | = 1.1 | No fix listed |
| pypi paramiko(PyPI) | = 1.2 | No fix listed |
| pypi paramiko(PyPI) | = 1.3 | No fix listed |
| pypi paramiko(PyPI) | = 1.3.1 | No fix listed |
| pypi paramiko(PyPI) | = 1.4 | No fix listed |
| pypi paramiko(PyPI) | = 1.5.1 | No fix listed |
| pypi paramiko(PyPI) | = 1.5.2 | No fix listed |
| pypi paramiko(PyPI) | = 1.5.4 | No fix listed |
| pypi paramiko(PyPI) | = 1.6 | No fix listed |
| pypi paramiko(PyPI) | = 1.6.1 | No fix listed |
| pypi paramiko(PyPI) | = 1.6.2 | No fix listed |
| pypi paramiko(PyPI) | = 1.6.3 | No fix listed |
| pypi paramiko(PyPI) | = 1.6.4 | No fix listed |
| pypi paramiko(PyPI) | = 1.7 | No fix listed |
| pypi paramiko(PyPI) | = 1.7.1 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi paramiko(PyPI) | < 1.7.2 | 1.7.2 |
| Python Software Foundation paramiko | = 1.7.1 | No fix listed |
| pypi paramiko(PyPI) | <= 1.7.1-2 | No fix listed |
| debian/paramiko(Debian:12) | < 1.6.4-1.1 | 1.6.4-1.1 |
| debian/paramiko(Debian:13) | < 1.6.4-1.1 | 1.6.4-1.1 |
| debian/paramiko(Debian:14) | < 1.6.4-1.1 | 1.6.4-1.1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking
- paramiko-randompool-info-disclosure(39749) vdb-entry
- github.com product
- github.com
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- FEDORA-2008-0644 vendor-advisory
- FEDORA-2008-0722 vendor-advisory
- bugs.debian.org
- people.debian.org exploit
- GLSA-200803-07 vendor-advisory
- www.lag.net
- 27307 vdb-entry
- 28488 third-party-advisory vendor-advisory
- 28510 third-party-advisory vendor-advisory
- 29168 third-party-advisory vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2008-0299 vendor-advisory
- bugs.debian.org issue-tracking