UnratedFix available
paramiko — security advisory
common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.
- Products
- paramiko
- Affected versions
- Not specified
- Fixed versions
- 1.6.4-1.1
- CVEs
- CVE-2008-0299
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 23:20 UTC · Revision 1
Source evidence
common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.
osv:DEBIAN-CVE-2008-0299
paramiko
Fixed versions: 1.6.4-1.1
paramiko
Fixed versions: 1.6.4-1.1
paramiko
Fixed versions: 1.6.4-1.1
Complete source record
{
"id": "0f2d68a4794207542c3caa80f00d75a04ff044c9139384fb5fdc0c67af789ee3",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2008-0299",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2008-0299",
"summary": "common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.",
"evidence": "osv:DEBIAN-CVE-2008-0299",
"products": [
{
"name": {
"value": "paramiko",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.6.4-1.1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "paramiko",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.6.4-1.1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "paramiko",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.6.4-1.1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2008-0299",
"aliases": [
"DEBIAN-CVE-2008-0299"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.4-1.1"
}
]
}
],
"package": {
"name": "paramiko",
"purl": "pkg:deb/debian/paramiko?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2008-0299.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.4-1.1"
}
]
}
],
"package": {
"name": "paramiko",
"purl": "pkg:deb/debian/paramiko?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2008-0299.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.4-1.1"
}
]
}
],
"package": {
"name": "paramiko",
"purl": "pkg:deb/debian/paramiko?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2008-0299.json"
},
"ecosystem_specific": {
"urgency": "low"
}
}
],
"modified": "2026-10-23T17:47:41.130714379Z",
"provider": "osv",
"upstream": [
"CVE-2008-0299"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2008-0299"
]
},
"related_cves": [
{
"value": "CVE-2008-0299",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 418342,
"published_at": "2008-01-16T23:00:00+00:00"
}