CVE-2008-0299 Paramiko Unsafe randomness usage may allow access to sensitive information
Attackers can predict RandomPool state in Paramiko to obtain sensitive information from other sessions when using threads or forked processes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-0299?
CVE-2008-0299 is a medium-severity vulnerability in n/a, published on 16 Jan 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.
Which versions are affected by CVE-2008-0299?
3 open source packages ship an affected version, including paramiko. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
paramiko PyPI | All versions | 1.7.1-3 |
paramiko PyPI | All versions | 1.7.1-3 |
paramiko PyPI | All versions | 1.7.2 |
Products include Python Software Foundation Paramiko.
How do I fix CVE-2008-0299?
Upgrade paramiko to a fixed version for your release line: 1.7.1-3 or 1.7.2.
Is CVE-2008-0299 being exploited?
There is no known exploitation of CVE-2008-0299 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2008-0299, GHSA-wqmm-q65g-2hqr, PYSEC-2008-8.