CVE-2022-24302 Race Condition in Paramiko
A race condition in Paramiko's private key writing allows attackers to read sensitive key data before permissions are set.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24302?
CVE-2022-24302 is a medium-severity vulnerability in Debian Debian Linux, published on 17 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.
Weakness: CWE-362
Which versions are affected by CVE-2022-24302?
5 open source packages ship an affected version, including paramiko. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
paramiko PyPI | All versions | 2.9.3, 2.10.1 |
paramiko PyPI | From 2.10.0 | 2.10.1 |
paramiko PyPI | From 2.10.0 | 2.10.1 |
paramiko PyPI | From 2.9.0 | 2.9.3 |
paramiko PyPI | From 2.9.0 | 2.9.3 |
Linux distribution packages (17)
python-paramiko Red Hat:openstack:16.1::el8 | All versions | 0:2.4.2-8.el8ost |
python3-paramiko Red Hat:openstack:16.1::el8 | All versions | 0:2.4.2-8.el8ost |
python-paramiko Red Hat:openstack:16.2::el8 | All versions | 0:2.4.2-8.el8ost |
python3-paramiko Red Hat:openstack:16.2::el8 | All versions | 0:2.4.2-8.el8ost |
python-paramiko Red Hat:rhev_hypervisor:4.4::el8 | All versions | 0:2.4.3-3.el8ev |
python-paramiko-doc Red Hat:rhev_hypervisor:4.4::el8 | All versions | 0:2.4.3-3.el8ev |
python3-paramiko Red Hat:rhev_hypervisor:4.4::el8 | All versions | 0:2.4.3-3.el8ev |
python-paramiko Red Hat:rhev_manager:4.4:el8 | All versions | 0:2.4.3-3.el8ev |
python-paramiko-doc Red Hat:rhev_manager:4.4:el8 | All versions | 0:2.4.3-3.el8ev |
python3-paramiko Red Hat:rhev_manager:4.4:el8 | All versions | 0:2.4.3-3.el8ev |
python-paramiko SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 2.4.2-150100.6.12.1 |
python-paramiko SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 2.4.0-9.13.1 |
python-paramiko SUSE:Linux Enterprise Module for Python 2 15 SP3 | All versions | 2.4.2-150100.6.12.1 |
python-paramiko SUSE:Linux Enterprise Real Time 15 SP2 | All versions | 2.4.2-150100.6.12.1 |
python-paramiko openSUSE:Leap 15.3 | All versions | 2.4.2-150100.6.12.1 |
python-paramiko openSUSE:Leap 15.4 | All versions | 2.4.2-150100.6.12.1 |
python-paramiko openSUSE:Tumbleweed | All versions | 3.3.1-2.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Paramiko Paramiko.
How do I fix CVE-2022-24302?
Upgrade paramiko to a fixed version for your release line: 2.9.3 or 2.10.1.
Is CVE-2022-24302 being exploited?
There is no known exploitation of CVE-2022-24302 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2022-24302, DLA-2959-1, DLA-3104-1, DLA-4409-1, GHSA-f8q4-jwww-x3wv, MGASA-2022-0132 and 11 more.