CVE-2022-24302

Published: 17 March 2022

In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.

Priority

CVSS 3 base score: 5.9

Status

Package	Release	Status
paramiko Launchpad, Ubuntu, Debian	bionic	Released (2.0.0-1ubuntu1.3)
	focal	Released (2.6.0-2ubuntu0.1)
	impish	Released (2.7.2-1ubuntu1.1)
	jammy	Released (2.8.1-1ubuntu3)
	trusty	Needs triage
	upstream	Needs triage
	xenial	Released (1.16.0-1ubuntu0.2+esm2)

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24302
https://www.paramiko.org/changelog.html
https://ubuntu.com/security/notices/USN-5351-1
https://ubuntu.com/security/notices/USN-5351-2
NVD
Launchpad
Debian

Bugs

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008012

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›