VDB
CVE-2008-0299
CVE-2008-0299
PUBLISHED
CVSS 7.099999904632568 HIGH
common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.
EPSS 1.62% · 76.0th percentile
Risk Scores
CVSS 4.0
7.099999904632568
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS Score
1.62%
76.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| python_software_foundation | paramiko | 1.7.1 |
| n/a | n/a | n/a |
| PyPI | paramiko | 0 |
Timeline
- Jan 16, 2008 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 22, 2022 EPSS Score
- Jul 15, 2022 EPSS Score
- Oct 30, 2022 EPSS Score
- Dec 22, 2022 EPSS Score
- Feb 13, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 8, 2023 EPSS Score
- May 31, 2023 EPSS Score
- Jul 23, 2023 EPSS Score
References
- GLSA-200803-07 vendor-advisory
- 29168 third-party-advisory
- 28488 third-party-advisory
- 27307 vdb
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=460706 url
- https://bugzilla.redhat.com/show_bug.cgi?id=428727 url
- FEDORA-2008-0644 vendor-advisory
- paramiko-randompool-info-disclosure(39749) vdb
- http://people.debian.org/~nion/nmu-diff/paramiko-1.6.4-1_1.6.4-1.1.patch url
- http://www.lag.net/pipermail/paramiko/2008-January/000599.html url
- 28510 third-party-advisory
- FEDORA-2008-0722 vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2008-0299 advisory
- https://github.com/paramiko/paramiko package
- https://github.com/pypa/advisory-database/tree/main/vulns/paramiko/PYSEC-2008-8.yaml url
- https://web.archive.org/web/20080205095439/http://secunia.com/advisories/28488 url
- https://web.archive.org/web/20080627172450/http://secunia.com/advisories/28510 url
- https://web.archive.org/web/20080628232710/http://secunia.com/advisories/29168 url
- https://web.archive.org/web/20080720033315/http://www.lag.net/pipermail/paramiko/2008-January/000599.html url
- https://web.archive.org/web/20081012023428/http://www.securityfocus.com/bid/27307 url