Description
common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | paramiko | 1.6.4-1.1 | — |
| Debian 13 | paramiko | 1.6.4-1.1 | — |
| Debian 12 | paramiko | 1.6.4-1.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | paramiko | < 1.7.1-3 | 1.7.1-3 | GHSA-wqmm-q65g-2hqr |
| PyPI | paramiko | < 1.7.2 | 1.7.2 | PYSEC-2008-8 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=428727
- FEDORA-2008-0644 vendor-advisory
- paramiko-randompool-info-disclosure(39749) vdb-entry
- http://people.debian.org/~nion/nmu-diff/paramiko-1.6.4-1_1.6.4-1.1.patch
- http://www.lag.net/pipermail/paramiko/2008-January/000599.html
- GLSA-200803-07 vendor-advisory
- 28510 third-party-advisory
- 29168 third-party-advisory
- 28488 third-party-advisory
- 27307 vdb-entry
- FEDORA-2008-0722 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=460706