Vulnerability · Published Mar 17, 2022 · Assigned by mitre
CVE-2022-24302
Medium 5.9
In plain English
A medium-severity security flaw in the paramiko package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.9Medium
Exploit odds (30 days)2.1%top 18.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | paramiko | 2.10.3-1 | DEBIAN-CVE-2022-24302 |
| Debian:13 | paramiko | 2.10.3-1 | DEBIAN-CVE-2022-24302 |
| Debian:14 | paramiko | 2.10.3-1 | DEBIAN-CVE-2022-24302 |
| PyPI | paramiko | 2.10.1 | GHSA-f8q4-jwww-x3wv |
| PyPI | paramiko | 2.9.3 | GHSA-f8q4-jwww-x3wv |
| PyPI | paramiko | 2.10.1, 2.9.3 | PYSEC-2022-166 |
| Ubuntu:22.04:LTS | paramiko | 2.8.1-1ubuntu3 | UBUNTU-CVE-2022-24302 |
Affected products (as reported)
References
- https://github.com/paramiko/paramiko/blob/363a28d94cada17f012c1604a3c99c71a2bda003/paramiko/pkey.py#L546 x_refsource_MISC
- https://www.paramiko.org/changelog.html x_refsource_MISC
- [debian-lts-announce] 20220321 [SECURITY] [DLA 2959-1] paramiko security update mailing-list, x_refsource_MLIST
- FEDORA-2022-bb5c461682 vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-8eb95d8611 vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-806492f1d1 vendor-advisory, x_refsource_FEDORA
- [debian-lts-announce] 20220912 [SECURITY] [DLA 3104-1] paramiko security update mailing-list, x_refsource_MLIST
- https://lists.debian.org/debian-lts-announce/2025/12/msg00020.html