rpm package
suse/python-paramiko&distro=SUSE Linux Enterprise Module for Public Cloud 12
pkg:rpm/suse/python-paramiko&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2012
Vulnerabilities (8)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-24302 | — | < 2.4.0-9.13.1 | 2.4.0-9.13.1 | Mar 17, 2022 | In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. | ||
| CVE-2021-33503 | — | < 2.4.0-9.10.2 | 2.4.0-9.10.2 | Jun 29, 2021 | An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected t | ||
| CVE-2013-5123 | — | < 1.18.5-2.15.1 | 1.18.5-2.15.1 | Nov 5, 2019 | The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks. | ||
| CVE-2018-1000805 | Hig | 8.8 | < 2.1.3-9.6.1 | 2.1.3-9.6.1 | Oct 8, 2018 | Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity. | |
| CVE-2018-7750 | Cri | 9.8 | < 1.15.2-2.9.1 | 1.15.2-2.9.1 | Mar 13, 2018 | transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing othe | |
| CVE-2013-7459 | Cri | 9.8 | < 1.15.2-2.6.1 | 1.15.2-2.6.1 | Feb 15, 2017 | Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py. | |
| CVE-2015-2296 | — | < 1.18.5-2.15.1 | 1.18.5-2.15.1 | Mar 18, 2015 | The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect. | ||
| CVE-2014-8991 | — | < 1.18.5-2.15.1 | 1.18.5-2.15.1 | Nov 24, 2014 | pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user. |
- CVE-2022-24302Mar 17, 2022affected < 2.4.0-9.13.1fixed 2.4.0-9.13.1
In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.
- CVE-2021-33503Jun 29, 2021affected < 2.4.0-9.10.2fixed 2.4.0-9.10.2
An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected t
- CVE-2013-5123Nov 5, 2019affected < 1.18.5-2.15.1fixed 1.18.5-2.15.1
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
- affected < 2.1.3-9.6.1fixed 2.1.3-9.6.1
Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.
- affected < 1.15.2-2.9.1fixed 1.15.2-2.9.1
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing othe
- affected < 1.15.2-2.6.1fixed 1.15.2-2.6.1
Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.
- CVE-2015-2296Mar 18, 2015affected < 1.18.5-2.15.1fixed 1.18.5-2.15.1
The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.
- CVE-2014-8991Nov 24, 2014affected < 1.18.5-2.15.1fixed 1.18.5-2.15.1
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.