debian/paramiko vulnerabilities

Latest debian/paramiko CVEs

Newest publication first

1. CVE-2026-44405 Paramiko rsakey.py allows the SHA-1 algorithm

   Published 2026-05-05

   Low·CVSS 3.4 EPSS 0.11%

   In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.

2. DLA-4409-1 paramiko - security update

   Published 2025-12-16

   Unknown

3. CVE-2023-48795 Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

   Published 2023-12-18

   Medium·CVSS 5.9 EPSS 93.5% Public exploit

   The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end...

4. DLA-3104-1 paramiko - security update

   Published 2022-09-12

   Unknown

5. DLA-2959-1 paramiko - security update

   Published 2022-03-21

   Unknown

6. CVE-2022-24302 Race Condition in Paramiko

   Published 2022-03-17

   Medium·CVSS 5.9 EPSS 2.1%

   In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.

7. DLA-2860-1 paramiko - security update

   Published 2021-12-28

   Unknown

8. DLA-1556-1 paramiko - security update

   Published 2018-10-27

   Unknown

9. CVE-2018-1000805 Paramiko Authentication Bypass vulnerability

   Published 2018-10-08

   High·CVSS 8.8 EPSS 4.4%

   Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.

10. CVE-2018-7750 Paramiko not properly checking authentication before processing other requests

    Published 2018-03-13

    Critical·CVSS 9.8 EPSS 27.1% Public exploit

    transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing othe...

11. CVE-2008-0299 Paramiko Unsafe randomness usage may allow access to sensitive information

    Published 2008-01-16

    Medium·CVSS 4.3 EPSS 1.6%

    common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.