CVE-2008-0299 | BDVDB-2026-28743 Detail
Description#
common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- https://bugzilla.redhat.com/show_bug.cgi?id=428727
- https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00529.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39749
- http://people.debian.org/~nion/nmu-diff/paramiko-1.6.4-1_1.6.4-1.1.patch
- http://www.lag.net/pipermail/paramiko/2008-January/000599.html
- http://security.gentoo.org/glsa/glsa-200803-07.xml
- http://secunia.com/advisories/28510
- http://secunia.com/advisories/29168
- http://secunia.com/advisories/28488
- http://www.securityfocus.com/bid/27307
- https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00594.html
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=460706
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.