# paramiko (PyPI) vulnerabilities

6 known vulnerabilities (1 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pypi.org/project/paramiko/

## Advisories (6)

### [CVE-2026-44405](https://cve.now/CVE-2026-44405): In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.

- Severity: Low 3.4
- Published: May 5, 2026
- Affected: through 4.0.0.

### [CVE-2023-48795](https://cve.now/CVE-2023-48795): The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypas

- Severity: Medium 5.9
- Published: Dec 18, 2023
- Affected: from 2.5.0, fixed in 3.4.0.

### [CVE-2022-24302](https://cve.now/CVE-2022-24302): In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write\_private\_key\_file function could allow unauthorized…

- Severity: Unrated
- Published: Mar 17, 2022
- Affected: fixed in 2.9.3; from 2.10.0, fixed in 2.10.1; from 2.10.0, fixed in 2.10.1; from 2.9.0, fixed in 2.9.3.

### [CVE-2018-1000805](https://cve.now/CVE-2018-1000805): Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that…

- Severity: Unrated
- Published: Oct 8, 2018
- Affected: from 2.4.0, fixed in 2.4.2; from 2.3.0, fixed in 2.3.3; from 2.2.0, fixed in 2.2.4; from 2.1.0, fixed in 2.1.6; from 1.5.1, fixed in 2.0.9.

### [CVE-2018-7750](https://cve.now/CVE-2018-7750): transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5…

- Severity: Unrated
- Published: Mar 13, 2018
- Affected: fixed in 1.17.6; from 1.18.0, fixed in 1.18.5; from 2.0.0, fixed in 2.0.8; from 2.1.0, fixed in 2.1.5; from 2.2.0, fixed in 2.2.3; from 2.3.0, fixed in 2.3.2; from 2.0.0, fixed in 2.0.8; from 2.1.0, fixed in 2.1.5; from 2.2.0, fixed in 2.2.3; from 2.3.0, fixed in 2.3.2; from 2.4.0, fixed in 2.4.1; from 1.18.0, fixed in 1.18.5; fixed in 1.17.6.

### [CVE-2008-0299](https://cve.now/CVE-2008-0299): common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one…

- Severity: Unrated
- Published: Jan 16, 2008
- Affected: fixed in 1.7.1-3; fixed in 1.7.2.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/paramiko
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.