CVE-2022-24302 — Race Condition in Paramiko

CWE-362 — Race Condition9 documents7 sources
Severity
5.9MEDIUMNVD
EPSS
0.7%
top 27.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
ParamikoDebian LinuxFedoraproject Fedora
Timeline
PublishedMar 17
Latest updateMar 29

Description

In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages3 packages

▶NVDparamiko/paramiko< 2.10.1
▶PyPIparamiko/paramiko2.10.0 — 2.10.1+1
▶Debianparamiko/paramiko< 2.7.2-1+deb11u1+3

Also affects: Debian Linux 10.0, 9.0, Fedora 34, 35, 36

🔴Vulnerability Details

4
OSV
Race Condition in Paramiko↗2022-03-19
▶
GHSA
Race Condition in Paramiko↗2022-03-19
▶
OSV
CVE-2022-24302: In Paramiko before 2↗2022-03-17
▶
CVEList
CVE-2022-24302: In Paramiko before 2↗2022-03-17
▶

📋Vendor Advisories

4
Ubuntu
Paramiko vulnerability↗2022-03-29
▶
Ubuntu
Paramiko vulnerability↗2022-03-28
▶
Red Hat
python-paramiko: Race condition in the write_private_key_file function↗2022-03-18
▶
Debian
CVE-2022-24302: paramiko - In Paramiko before 2.10.1, a race condition (between creation and chmod) in the ...↗2022
▶