CVE-2008-0299 — Vulnetix

CVE-2008-0299 PUBLISHED CVSS 4.300000190734863 MEDIUM

common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.

EPSS 1.32% · 80.2th percentile

Risk Scores

CVSS 2.0

4.300000190734863

EPSS Score

1.32%

80.2th percentile

Affected Products

Vendor	Product	Versions
python_software_foundation	paramiko	1.7.1
n/a	n/a	n/a
PyPI	paramiko	0

Timeline

Jan 16, 2008 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 20, 2022 EPSS Score
Jul 12, 2022 EPSS Score
Oct 26, 2022 EPSS Score
Dec 18, 2022 EPSS Score
Feb 9, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 3, 2023 EPSS Score
May 25, 2023 EPSS Score
Jul 17, 2023 EPSS Score

References

https://bugzilla.redhat.com/show_bug.cgi?id=428727 url
FEDORA-2008-0644 vendor-advisory
paramiko-randompool-info-disclosure(39749) vdb
http://people.debian.org/~nion/nmu-diff/paramiko-1.6.4-1_1.6.4-1.1.patch url
http://www.lag.net/pipermail/paramiko/2008-January/000599.html url
GLSA-200803-07 vendor-advisory
28510 third-party-advisory
29168 third-party-advisory
28488 third-party-advisory
27307 vdb
FEDORA-2008-0722 vendor-advisory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=460706 url
https://nvd.nist.gov/vuln/detail/CVE-2008-0299 advisory
https://github.com/paramiko/paramiko package
https://github.com/pypa/advisory-database/tree/main/vulns/paramiko/PYSEC-2008-8.yaml url
https://web.archive.org/web/20080205095439/http://secunia.com/advisories/28488 url
https://web.archive.org/web/20080627172450/http://secunia.com/advisories/28510 url
https://web.archive.org/web/20080628232710/http://secunia.com/advisories/29168 url
https://web.archive.org/web/20080720033315/http://www.lag.net/pipermail/paramiko/2008-January/000599.html url
https://web.archive.org/web/20081012023428/http://www.securityfocus.com/bid/27307 url

Open in Interactive Console →