Description
In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | paramiko | 2.10.3-1 | — |
| Debian 13 | paramiko | 2.10.3-1 | — |
| Debian 12 | paramiko | 2.10.3-1 | — |
| Debian 11 | paramiko | 2.7.2-1+deb11u1 | DLA-4409-1 |
| Debian 10 | paramiko | 2.4.2-0.1+deb10u1 | DLA-3104-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | paramiko | 2.0.0-1+deb9u2 | DLA-2959-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | paramiko | 2.8.1-1ubuntu3 | — |
| Ubuntu 20.04 LTS | paramiko | 2.6.0-2ubuntu0.1 | USN-5351-1 |
| Ubuntu 18.04 LTS | paramiko | 2.0.0-1ubuntu1.3 | USN-5351-1 |
| Ubuntu 14.04 LTS | paramiko | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | paramiko | 1.16.0-1ubuntu0.2+esm2 | USN-5351-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | python-paramiko +2 | 2.4.3-3.el8ev | RHSA-2022:4712 |
| Red Hat Rhev Hypervisor 4 | python-paramiko +2 | 2.4.3-3.el8ev | RHSA-2022:4712 |
| Red Hat OpenStack 16 | python-paramiko +1 | 2.4.2-8.el8ost | RHSA-2022:8863, RHSA-2022:8845 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | python-paramiko | 2.4.2-150100.6.12.1 | SUSE-SU-2022:1446-1 |
| SLES 12 | python-paramiko | 2.4.0-9.13.1 | SUSE-SU-2022:1447-1 |
| SLES 2 | python-paramiko | 2.4.2-150100.6.12.1 | SUSE-SU-2022:1446-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Real Time 15 SP2 | python-paramiko | 2.4.2-150100.6.12.1 | SUSE-SU-2022:1446-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-paramiko | 3.3.1-2.1 | openSUSE-SU-2026:12025-1, openSUSE-SU-2024:13300-1 |
| openSUSE Leap 15.4 | python-paramiko | 2.4.2-150100.6.12.1 | SUSE-SU-2022:1446-1 |
| openSUSE Leap 15.3 | python-paramiko | 2.4.2-150100.6.12.1 | SUSE-SU-2022:1446-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | paramiko | >= 2.10.0, < 2.10.1 | 2.10.1 | GHSA-f8q4-jwww-x3wv |
| PyPI | paramiko | >= 2.9.0, < 2.9.3 | 2.9.3 | GHSA-f8q4-jwww-x3wv |
| PyPI | paramiko | < 2.9.3 · >= 2.10.0, < 2.10.1 | 2.9.3, 2.10.1 | PYSEC-2022-166 |
Advisories 14
- openSUSE-SU-2026:12025-1 python313-paramiko-5.0.0-1.2 on GA media SUSE / openSUSE Security Updates · Oct 5, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-5351-2 paramiko vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-5351-1 paramiko vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-3104-1 paramiko - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2959-1 paramiko - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2022:1446-1 Security update for python-paramiko SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1447-1 Security update for python-paramiko SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2022:8863 Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (python-paramiko) security update Red Hat Security Advisories (RHSA) · Dec 16, 2025
- RHSA-2022:8845 Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (python-paramiko) security update Red Hat Security Advisories (RHSA) · Dec 16, 2025
- RHSA-2022:4712 Red Hat Security Advisory: RHV Engine and Host Common Packages security update Red Hat Security Advisories (RHSA) · Dec 16, 2025
- DLA-4409-1 paramiko - security update Debian Security (DSA / DLA) · Dec 16, 2025
- WID-SEC-2022-2256 Red Hat Enterprise Linux und Virtualization: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Dec 15, 2025
- openSUSE-SU-2024:13300-1 python-paramiko-doc-3.3.1-2.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- https://github.com/paramiko/paramiko/blob/363a28d94cada17f012c1604a3c99c71a2bda003/paramiko/pkey.py#L546
- https://www.paramiko.org/changelog.html
- [debian-lts-announce] 20220321 [SECURITY] [DLA 2959-1] paramiko security update mailing-list
- FEDORA-2022-bb5c461682 vendor-advisory
- FEDORA-2022-8eb95d8611 vendor-advisory
- FEDORA-2022-806492f1d1 vendor-advisory
- [debian-lts-announce] 20220912 [SECURITY] [DLA 3104-1] paramiko security update mailing-list