CVE-2008-0299

common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.
Severity
UNKNOWN
AV:N/AC:M/Au:N/C:P/I:N/A:N
Atk. Vector
NETWORK
Atk. Complexity
MEDIUM
Base Score
CVSS 3.x
EPSS Score
Percentile: 81%
VendorProductVersion
python_software_foundationparamiko
1.7.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
paramiko
bullseye
2.7.2-1
fixed
etch
no-dsa
bookworm
2.12.0-2
fixed
sid
3.4.1-2
fixed
trixie
3.4.1-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
paramiko
natty
not-affected
maverick
not-affected
lucid
not-affected
karmic
not-affected
jaunty
not-affected
intrepid
not-affected
hardy
ignored
gutsy
ignored
feisty
ignored
edgy
ignored
dapper
ignored
References
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=460706
http://people.debian.org/~nion/nmu-diff/paramiko-1.6.4-1_1.6.4-1.1.patch
http://secunia.com/advisories/28488
http://secunia.com/advisories/28510
http://secunia.com/advisories/29168
http://security.gentoo.org/glsa/glsa-200803-07.xml
http://www.lag.net/pipermail/paramiko/2008-January/000599.html
http://www.securityfocus.com/bid/27307
https://bugzilla.redhat.com/show_bug.cgi?id=428727
https://exchange.xforce.ibmcloud.com/vulnerabilities/39749
https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00529.html
https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00594.html