Paramiko Unsafe randomness usage may allow access to sensitive information
common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2008-0299US | medium4.3 | — | ||
common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from ano… | ||||
02
references
External citations — patches, advisories, analysis.
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=460706WEB
- http://people.debian.org/~nion/nmu-diff/paramiko-1.6.4-1_1.6.4-1.1.patchWEB
- http://security.gentoo.org/glsa/glsa-200803-07.xmlWEB
- https://bugzilla.redhat.com/show_bug.cgi?id=428727WEB
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39749WEB
- https://github.com/paramiko/paramikoPACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/paramiko/PYSEC-2008-8.yamlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2008-0299ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan