CVE-2008-0299 json
Paramiko Unsafe randomness usage may allow access to sensitive information
published 2008-01-16 18 y ago modified 2026-06-16 4 mo ago also GHSA-wqmm-q65g-2hqr , PYSEC-2008-8 , EUVD-2008-0007
- cvss
- 6.5
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known
Summary
common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.
Patch / fix
- pypi paramiko 1.7.1-3, 1.7.2
- paramiko Debian 14, Debian 13, Debian 12 1.6.4-1.1
debian advisories DEBIAN-CVE-2008-0299
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2008-0299 updated
Paramiko insecure use of RandomPool
-
Red Hat All currently supported Red Hat productsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.62% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- people.debian.org http://people.debian.org/~nion/nmu-diff/paramiko-1.6.4-1_1.6.4-1.1.patch referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | paramiko | <1.7.1-3 <1.7.2 |
1.7.1-3 1.7.2 |
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
people.debian.org
/~nion/nmu-diff/paramiko-1.6.4-1_1.6.4-1.1.patch
web, exploit
-
redhat.com
/archives/fedora-package-announce/2008-January/msg00529.html
vendor-advisory, web
-
security.gentoo.org
/glsa/glsa-200803-07.xml
vendor-advisory, web, advisory
-
redhat.com
/archives/fedora-package-announce/2008-January/msg00594.html
vendor-advisory, web
-
bugzilla.redhat.com
/show_bug.cgi?id=428727
web, report
-
exchange.xforce.ibmcloud.com
/vulnerabilities/39749
vdb-entry, web
-
lag.net
/pipermail/paramiko/2008-January/000599.html
web
-
secunia.com
/advisories/28510
third-party-advisory, advisory
-
secunia.com
/advisories/29168
third-party-advisory, advisory
-
secunia.com
/advisories/28488
third-party-advisory, advisory
-
securityfocus.com
/bid/27307
vdb-entry, web
-
bugs.debian.org
/cgi-bin/bugreport.cgi?bug=460706
web
-
nvd.nist.gov
/vuln/detail/CVE-2008-0299
advisory
-
github.com
/paramiko/paramiko
package
-
github.com
/pypa/advisory-database/tree/main/vulns/paramiko/PYSEC-2008-8.yaml
web
-
web.archive.org
/web/20080205095439/http://secunia.com/advisories/28488
web
-
web.archive.org
/web/20080627172450/http://secunia.com/advisories/28510
web
-
web.archive.org
/web/20080628232710/http://secunia.com/advisories/29168
web
-
web.archive.org
/web/20080720033315/http://www.lag.net/pipermail/paramiko/2008-January/000599.html
web
-
web.archive.org
/web/20081012023428/http://www.securityfocus.com/bid/27307
web
-
github.com
/advisories/GHSA-wqmm-q65g-2hqr
advisory
Sources
- CVE List CVE-2008-0299
- GitHub Advisory GHSA-wqmm-q65g-2hqr
- NVD CVE-2008-0299
- OSV PYSEC-2008-8
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.