PYSEC-2008-8
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/paramiko/PYSEC-2008-8.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2008-8
- Aliases
- Published
- 2008-01-16T23:00:00Z
- Modified
- 2024-02-09T19:56:39.037048Z
- Summary
- [none]
- Details
-
common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.
- References
-
- http://people.debian.org/~nion/nmu-diff/paramiko-1.6.4-1_1.6.4-1.1.patch
- http://www.lag.net/pipermail/paramiko/2008-January/000599.html
- https://bugzilla.redhat.com/show_bug.cgi?id=428727
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=460706
- https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00529.html
- https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00594.html
- http://www.securityfocus.com/bid/27307
- http://secunia.com/advisories/28488
- http://secunia.com/advisories/28510
- http://security.gentoo.org/glsa/glsa-200803-07.xml
- http://secunia.com/advisories/29168
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39749
Affected packages
PyPI / paramiko
Package
- Name
- paramiko
- View open source insights on deps.dev
- Purl
- pkg:pypi/paramiko