Paramiko: Information disclosure

1. Gentoo Linux Security Advisory

Advisory Reference	GLSA 200803-07 / paramiko
Release Date	March 03, 2008
Latest Revision	March 03, 2008: 01
Impact	low
Exploitable	remote

Package	Vulnerable versions	Unaffected versions	Architecture(s)
dev-python/paramiko	< 1.7.2	>= 1.7.2	All supported architectures

Related bugreports: #205777

Synopsis

Unsafe randomness usage in Paramiko may allow access to sensitive information.

2. Impact Information

Background

Paramiko is a Secure Shell Server implementation written in Python.

Description

Dwayne C. Litzenberger reported that the file "common.py" does not properly use RandomPool when using threads or forked processes.

Impact

A remote attacker could predict the values generated by applications using Paramiko for encryption purposes, potentially gaining access to sensitive information.

3. Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All Paramiko users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-python/paramiko-1.7.2"

4. References

CVE-2008-0299

Page updated March 03, 2008

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.