Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

paramiko

6 known vulnerabilities (1 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 1 medium, 1 low
Registry
PyPI

Advisories 6

  • In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.

    Affected: through 4.0.0.

  • CVE-2023-48795Medium 5.9

    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypas

    Affected: from 2.5.0, fixed in 3.4.0.

  • In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized…

    Affected: fixed in 2.9.3; from 2.10.0, fixed in 2.10.1; from 2.10.0, fixed in 2.10.1; from 2.9.0, fixed in 2.9.3.

  • Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that…

    Affected: from 2.4.0, fixed in 2.4.2; from 2.3.0, fixed in 2.3.3; from 2.2.0, fixed in 2.2.4; from 2.1.0, fixed in 2.1.6; from 1.5.1, fixed in 2.0.9.

  • transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5…

    Affected: fixed in 1.17.6; from 1.18.0, fixed in 1.18.5; from 2.0.0, fixed in 2.0.8; from 2.1.0, fixed in 2.1.5; from 2.2.0, fixed in 2.2.3; from 2.3.0, fixed in 2.3.2; from 2.0.0, fixed in 2.0.8; from 2.1.0, fixed in 2.1.5; from 2.2.0, fixed in 2.2.3; from 2.3.0, fixed in 2.3.2; from 2.4.0, fixed in 2.4.1; from 1.18.0, fixed in 1.18.5; fixed in 1.17.6.

  • common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one…

    Affected: fixed in 1.7.1-3; fixed in 1.7.2.