{"id":"CVE-2022-24302","aliases":["DEBIAN-CVE-2022-24302","DLA-2959-1","DLA-3104-1","DLA-4409-1","EUVD-2022-0192","GHSA-f8q4-jwww-x3wv","MGASA-2022-0132","OESA-2022-1609","PYSEC-2022-166","RHSA-2022:4712","RHSA-2022:8845","RHSA-2022:8863","SUSE-SU-2022:1446-1","SUSE-SU-2022:1447-1","SUSE-SU-2022:1536-1","UBUNTU-CVE-2022-24302","USN-5351-1","USN-5351-2","openSUSE-SU-2024:13300-1","openSUSE-SU-2026:12025-1"],"status":"published","title":"Race Condition in Paramiko","description":"In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0208,"percentile":0.81652,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2022-03-17T21:02:10Z","modified":"2026-11-03T08:01:04Z","fixes":[{"ecosystem":"PyPI","package":"paramiko","fixed_in":["2.10.1","2.9.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"paramiko","fixed_in":["2.10.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"paramiko","fixed_in":["2.10.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"paramiko","fixed_in":["2.10.3-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"paramiko","fixed_in":["2.0.0-1+deb9u2"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"paramiko","fixed_in":["2.4.2-0.1+deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"paramiko","fixed_in":["2.7.2-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"python-paramiko","fixed_in":["2.7.2-1.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"python-paramiko","fixed_in":["2.7.2-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"python-paramiko","fixed_in":["2.7.2-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"python-paramiko","fixed_in":["2.7.2-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"python-paramiko","fixed_in":["2.8.1-3.oe2203"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_hypervisor:4.4::el8","package":"python-paramiko","fixed_in":["0:2.4.3-3.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_hypervisor:4.4::el8","package":"python-paramiko-doc","fixed_in":["0:2.4.3-3.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_hypervisor:4.4::el8","package":"python3-paramiko","fixed_in":["0:2.4.3-3.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"python-paramiko","fixed_in":["0:2.4.3-3.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"python-paramiko-doc","fixed_in":["0:2.4.3-3.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"python3-paramiko","fixed_in":["0:2.4.3-3.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python-paramiko","fixed_in":["0:2.4.2-8.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-paramiko","fixed_in":["0:2.4.2-8.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"python-paramiko","fixed_in":["0:2.4.2-8.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-paramiko","fixed_in":["0:2.4.2-8.el8ost"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"python-paramiko","fixed_in":["2.4.2-150100.6.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP3","package":"python-paramiko","fixed_in":["2.4.2-150100.6.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"python-paramiko","fixed_in":["2.4.2-150100.6.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"python-paramiko","fixed_in":["2.4.2-150100.6.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"python-paramiko","fixed_in":["2.4.2-150100.6.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-paramiko","fixed_in":["2.4.0-9.13.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"paramiko","fixed_in":["1.16.0-1ubuntu0.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"paramiko","fixed_in":["2.0.0-1ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"paramiko","fixed_in":["2.6.0-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"paramiko","fixed_in":["2.8.1-1ubuntu3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-paramiko","fixed_in":["3.3.1-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1+deb9u2"}]}],"versions":["2.0.0-1","2.0.0-1+deb9u1"]},{"source":"osv","ecosystem":"Debian:10","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-0.1+deb10u1"}]}],"versions":["2.4.2-0.1"]},{"source":"osv","ecosystem":"Debian:11","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.2-1+deb11u1"}]}],"versions":["2.7.2-1"]},{"source":"osv","ecosystem":"PyPI","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.1"}]}],"versions":["2.10.0"]},{"source":"osv","ecosystem":"PyPI","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.3"}]}],"versions":["2.9.0","2.9.1","2.9.2"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.2-1.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.2-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.2-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.2-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-3.oe2203"}]}]},{"source":"osv","ecosystem":"PyPI","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3"},{"introduced":"2.10.0"},{"fixed":"2.10.1"}]}],"versions":["0.1-bulbasaur","0.1-charmander","0.9-doduo","0.9-eevee","0.9-fearow","0.9-gyarados","0.9-horsea","0.9-ivysaur","1.0","1.1","1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.11.0","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.13.0","1.13.1","1.13.2","1.13.3","1.13.4","1.14.0","1.14.1","1.14.2","1.14.3","1.15.0","1.15.1","1.15.2","1.15.3","1.15.4","1.15.5","1.16.0","1.16.1","1.16.2","1.16.3","1.17.0","1.17.1","1.17.2","1.17.3","1.17.4","1.17.5","1.17.6","1.18.0","1.18.1","1.18.2","1.18.3","1.18.4","1.18.5","1.2","1.3","1.3.1","1.4","1.5.1","1.5.2","1.5.4","1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.7","1.7.1","1.7.2","1.7.4","1.7.5","1.7.6","1.7.7.1","1.7.7.2","1.8.0","1.8.1","1.9.0","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.10.0","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.3.0","2.3.1","2.3.2","2.3.3","2.4.0","2.4.1","2.4.2","2.4.3","2.5.0","2.5.1","2.6.0","2.7.0","2.7.1","2.7.2","2.8.0","2.8.1","2.9.0","2.9.1","2.9.2"]},{"source":"osv","ecosystem":"Red Hat:rhev_hypervisor:4.4::el8","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.3-3.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_hypervisor:4.4::el8","package":"python-paramiko-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.3-3.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_hypervisor:4.4::el8","package":"python3-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.3-3.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.3-3.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"python-paramiko-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.3-3.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"python3-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.3-3.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.2-8.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.2-8.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.2-8.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.2-8.el8ost"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150100.6.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP3","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150100.6.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150100.6.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150100.6.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150100.6.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-9.13.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.1-1","1.10.1-1git1","1.10.1-1git1build1","1.10.1-1git1ubuntu0.1","1.10.1-1git1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-1ubuntu0.2+esm2"}]}],"versions":["1.15.2-1","1.15.3-1","1.15.3-1ubuntu1","1.16.0-1","1.16.0-1ubuntu0.1","1.16.0-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1ubuntu1.3"}]}],"versions":["2.0.0-1","2.0.0-1ubuntu1","2.0.0-1ubuntu1.1","2.0.0-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-2ubuntu0.1"}]}],"versions":["2.6.0-1","2.6.0-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-1ubuntu3"}]}],"versions":["2.7.2-1ubuntu1","2.8.0-1ubuntu1","2.8.1-1ubuntu1","2.8.1-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1ubuntu1.3"}]}],"versions":["2.0.0-1","2.0.0-1ubuntu1","2.0.0-1ubuntu1.1","2.0.0-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-2ubuntu0.1"}]}],"versions":["2.6.0-1","2.6.0-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-1ubuntu0.2+esm2"}]}],"versions":["1.15.2-1","1.15.3-1","1.15.3-1ubuntu1","1.16.0-1","1.16.0-1ubuntu0.1","1.16.0-1ubuntu0.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-1.2"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"paramiko","product":"paramiko"}],"references":[{"url":"https://github.com/paramiko/paramiko/blob/363a28d94cada17f012c1604a3c99c71a2bda003/paramiko/pkey.py#L546","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://www.paramiko.org/changelog.html","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00032.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U63MJ2VOLLQ35R7CYNREUHSXYLWNPVSB/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LUEUEGILZ7MQXRSUF5VMMO4SWJQVPTQL/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPMKRUS4HO3P7NR7P4Y6CLHB4MBEE3AI/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00013.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/12/msg00020.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24302","tags":["advisory"]},{"url":"https://github.com/paramiko/paramiko/commit/4c491e299c9b800358b16fa4886d8d94f45abe2e","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f8q4-jwww-x3wv","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/paramiko/PYSEC-2022-166.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LUEUEGILZ7MQXRSUF5VMMO4SWJQVPTQL","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TPMKRUS4HO3P7NR7P4Y6CLHB4MBEE3AI","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U63MJ2VOLLQ35R7CYNREUHSXYLWNPVSB","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LUEUEGILZ7MQXRSUF5VMMO4SWJQVPTQL","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPMKRUS4HO3P7NR7P4Y6CLHB4MBEE3AI","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U63MJ2VOLLQ35R7CYNREUHSXYLWNPVSB","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24302.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-24302","tags":["advisory"]},{"url":"https://github.com/paramiko/paramiko","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2022-0132.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30193","tags":["report"]},{"url":"https://www.debian.org/lts/security/2022/dla-2959","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1609","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:4712","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1883949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1932149","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1933555","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1940824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004852","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2006721","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2017070","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034313","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044362","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060763","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064798","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064799","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064801","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2065665","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066811","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2071365","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4712.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24302","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24302","tags":["advisory","report"]},{"url":"https://github.com/paramiko/paramiko/releases/tag/2.10.1","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8845","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8845.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8863","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8863.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221446-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1197279","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24302","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221447-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221536-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1118088","tags":["report"]},{"url":"https://bugzilla.suse.com/1184177","tags":["report"]},{"url":"https://bugzilla.suse.com/1196249","tags":["report"]},{"url":"https://bugzilla.suse.com/1196877","tags":["report"]},{"url":"https://bugzilla.suse.com/1197417","tags":["report"]},{"url":"https://bugzilla.suse.com/1197637","tags":["report"]},{"url":"https://bugzilla.suse.com/1198556","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22941","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-24302","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5351-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5351-2","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48795","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-24302","description":"In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.","status":"published","published":"2022-03-17T21:02:10Z","modified":"2025-12-16T01:31:54.07Z","updated_at":"2026-11-02T14:34:34.576287Z"}],"euvd":[{"id":"EUVD-2022-0192","description":"In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.","status":"published","published":"2022-03-17T21:02:10Z","modified":"2025-12-16T01:31:54Z","updated_at":"2026-11-02T19:49:05.078672Z"}],"ghsa":[{"id":"GHSA-f8q4-jwww-x3wv","title":"Race Condition in Paramiko","description":"In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.","status":"published","published":"2022-03-19T00:01:03Z","modified":"2025-12-20T02:31:13Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:39:14.093341Z"}],"nvd":[{"id":"CVE-2022-24302","description":"In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.","status":"published","published":"2022-03-17T22:15:08.9Z","modified":"2026-06-17T04:31:34.943Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:07:14.24948Z"}],"osv":[{"id":"DEBIAN-CVE-2022-24302","description":"In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.","status":"published","published":"2022-03-17T22:15:08.9Z","modified":"2026-11-03T08:01:04.084849581Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"GHSA-f8q4-jwww-x3wv","title":"Race Condition in Paramiko","description":"In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.","status":"published","published":"2022-03-19T00:01:03Z","modified":"2025-12-20T03:08:14.593089Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"OESA-2022-1609","title":"python-paramiko security update","description":"Paramiko is a combination of the Esperanto words for \"paranoid\" and \"friend\". It is a module for Python 2.7/3.4+ that implements the SSH2 protocol for secure (encrypted and authenticated) connections to remote machines.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.(CVE-2022-24302)","status":"published","published":"2022-04-12T11:04:53Z","modified":"2026-08-18T01:16:28.391073958Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2022:4712","title":"Red Hat Security Advisory: RHV Engine and Host Common Packages security update","status":"published","published":"2024-09-18T05:54:48Z","modified":"2025-12-16T10:24:26.311913Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:8845","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (python-paramiko) security update","status":"published","published":"2024-09-18T05:56:05Z","modified":"2025-12-16T10:24:37.4527Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:8863","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (python-paramiko) security update","status":"published","published":"2024-09-18T05:55:47Z","modified":"2025-12-16T10:24:38.302386Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"UBUNTU-CVE-2022-24302","description":"In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.","status":"published","published":"2022-03-17T22:15:00Z","modified":"2026-02-04T03:58:02.305869Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"CVE-2022-24302","description":"In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.","status":"published","published":"2022-03-17T21:02:10Z","modified":"2026-10-28T02:31:13.563114891Z","updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"DLA-2959-1","title":"paramiko - security update","status":"published","published":"2022-03-21T00:00:00Z","modified":"2026-03-09T01:20:53.866174Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3104-1","title":"paramiko - security update","status":"published","published":"2022-09-12T00:00:00Z","modified":"2026-03-09T01:20:58.057909Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-4409-1","title":"paramiko - security update","status":"published","published":"2025-12-16T00:00:00Z","modified":"2025-12-16T01:29:55.065999Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2022-0132","title":"Updated python-paramiko packages fix security vulnerability","description":"In Paramiko before 2.10.1, a race condition (between creation and chmod)\nin the write_private_key_file function could allow unauthorized\ninformation disclosure. (CVE-2022-24302)\n","status":"published","published":"2022-04-09T21:20:39Z","modified":"2026-04-16T04:44:02.797059243Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:13300-1","title":"python-paramiko-doc-3.3.1-2.1 on GA media","description":"These are all security issues fixed in the python-paramiko-doc-3.3.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:13:50.879545Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2026:12025-1","title":"python313-paramiko-5.0.0-1.2 on GA media","description":"These are all security issues fixed in the python313-paramiko-5.0.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:56.233256181Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"PYSEC-2022-166","description":"In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.","status":"published","published":"2022-03-17T22:15:00Z","modified":"2023-11-08T04:08:30.555889Z","updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"SUSE-SU-2022:1446-1","title":"Security update for python-paramiko","description":"This update for python-paramiko fixes the following issues:\n\n- CVE-2022-24302: Fixed a race condition between creation and chmod when writing private keys. (bsc#1197279) \n","status":"published","published":"2022-04-28T07:47:16Z","modified":"2026-02-04T03:41:44.583296Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1447-1","title":"Security update for python-paramiko","description":"This update for python-paramiko fixes the following issues:\n\n- CVE-2022-24302: Fixed a race condition between creation and chmod when writing private keys. (bsc#1197279) \n","status":"published","published":"2022-04-28T07:47:28Z","modified":"2026-02-04T02:24:14.578654Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1536-1","title":"Security Beta update for SUSE Manager Salt Bundle","description":"This update fixes the following issues:\n\nvenv-salt-minion:\n\n- Fix the regression caused by the patch removing strict requirement for\n  OpenSSL 1.1.1 leading to read/write issues with ssl module for\n  SLE 15, SLE 12, CentOS 7, Debian 9 (bsc#1198556)\n- Fixes for Python 3.10\n- Fix salt-ssh opts poisoning (bsc#1197637)\n- Fix multiple security issues (bsc#1197417)\n  * CVE-2022-22935: Sign authentication replies to prevent MiTM\n  * CVE-2022-22934: Sign pillar data to prevent MiTM attacks.\n  * CVE-2022-22936: Prevent job and fileserver replays.\n  * CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth.\n- Salt version bump to 3004\n- Python version bump to 3.10.2\n- CVE-2022-24302: unauthorized information disclosure for python-paramiko.\n- CVE-2021-28957: XSS due to missing input sanitization in python-lxml.\n- CVE-2018-19787: XSS attacks due to missing URLs sanitization in python-lxml.\n- Security Fix: (bsc#1196249, bsc#1196877, CVE-2022-0778)\n  * Allow CRYPTO_THREADID_set_callback to be called with NULL parameter\n  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates \n","status":"published","published":"2022-05-04T13:33:28Z","modified":"2026-02-04T03:09:33.996286Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-5351-1","title":"paramiko vulnerability","description":"Jan Schejbal discovered that Paramiko incorrectly handled permissions when\nwriting private key files. A local attacker could possibly use this issue\nto gain access to private keys.\n","status":"published","published":"2022-03-28T16:43:01Z","modified":"2026-04-27T16:05:59.928386Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5351-2","title":"paramiko vulnerability","description":"USN-5351-1 fixed a vulnerability in Paramiko. This update provides\nthe corresponding update for Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n Jan Schejbal discovered that Paramiko incorrectly handled permissions when\n writing private key files. A local attacker could possibly use this issue\n to gain access to private keys.\n","status":"published","published":"2022-03-30T07:33:49Z","modified":"2026-06-25T13:31:06.411578883Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}