Skip to content
OpenAdvisories
Medium USN-5351-1 1 CVE

paramiko vulnerability

Published Mar 28, 2022 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Jan Schejbal discovered that Paramiko incorrectly handled permissions when
writing private key files. A local attacker could possibly use this issue
to gain access to private keys.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS paramiko 2.0.0-1ubuntu1.3
Ubuntu · 20.04 LTS 20.04:LTS paramiko 2.6.0-2ubuntu0.1

Vulnerabilities 1

  • Medium 5.9
    CVE-2022-24302

    Race Condition in Paramiko

    In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.

    paramiko paramiko paramiko Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2022-24302