CVE-2022-24302: Race Condition
In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-24302?
CVE-2022-24302 is a vulnerability in Paramiko that allows unauthorized information disclosure due to a race condition in the write_private_key_file function.
What is the severity of CVE-2022-24302?
The severity of CVE-2022-24302 is medium with a CVSS score of 5.9.
How does CVE-2022-24302 affect Paramiko?
CVE-2022-24302 affects Paramiko versions before 2.10.1.
How can I fix CVE-2022-24302?
To fix CVE-2022-24302, you should upgrade to Paramiko version 2.10.1 or later.
Are there any references available for CVE-2022-24302?
Yes, you can find more information about CVE-2022-24302 at the following references: NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-24302), GitHub (https://github.com/paramiko/paramiko/blob/363a28d94cada17f012c1604a3c99c71a2bda003/paramiko/pkey.py#L546), Paramiko Changelog (https://www.paramiko.org/changelog.html).