Executive brief
In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.
Affected products
- PyPI paramiko
Junglewise Threat Intelligence
CVE-2022-24302: PYSEC-2022-166 - In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized inf
CVE-2022-24302 · Severity: low · CVSS 3.1 · Published 2022-03-17
Technologies: paramiko (PyPI). Vendors: PyPI.
Related threats
- Paramiko use of broken SHA-1 algorithm in RSA key handling
- OpenSSH and others SSH prefix truncation vulnerability (Terrapin)
- PYSEC-2018-69 - Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can
- Paramiko authentication bypass in SSH server implementation
- PYSEC-2008-8 - common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session