CVE-2008-0299: Infoleak
common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.
Other sources
Description of problem:
Programs that maintain multiple simultaneous paramiko connections (Transport instances) via forking or threading may be vulnerable to attacks on paramiko's random number generator. See URL for details.
http://www.lag.net/pipermail/paramiko/2008-January/000599.html http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=460706
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-0299?
CVE-2008-0299 is classified as having moderate severity due to potential exposure of sensitive information between sessions.
How do I fix CVE-2008-0299?
To fix CVE-2008-0299, upgrade Paramiko to version 1.7.2 or later.
What are the affected versions for CVE-2008-0299?
CVE-2008-0299 affects Paramiko versions 1.7.1 and earlier.
What does CVE-2008-0299 exploit?
CVE-2008-0299 exploits a flaw in the RandomPool implementation in Paramiko, allowing session information leakage.
Which software contains CVE-2008-0299?
CVE-2008-0299 is found in Paramiko, specifically in version 1.7.1 and earlier.