CVE catalog

CVE-2022-24302

paramiko: CVE-2022-24302

[CVE catalog]

Severity
Medium · CVSS 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.08% · Oct 25, 2026

In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianparamikosid5.0.0-1fixed
Debianparamikoforky5.0.0-1fixed
Debianparamikotrixie3.5.1-3fixed
Debianparamikobookworm2.12.0-2fixed
Opensusepython-paramikotumbleweed5.0.0-1.2fixed
Ubuntuparamikopro1.15.2-1vulnerable
Ubuntuparamikopro1.15.3-1vulnerable
Ubuntuparamikopro1.15.3-1ubuntu1vulnerable
Ubuntuparamikopro1.16.0-1vulnerable
Ubuntuparamikopro1.16.0-1ubuntu0.1vulnerable
Ubuntuparamikopro1.16.0-1ubuntu0.2vulnerable
Ubuntuparamikopro1.16.0-1ubuntu0.2+esm2fixed
Ubuntuparamiko18.042.0.0-1vulnerable
Ubuntuparamiko18.042.0.0-1ubuntu1vulnerable
Ubuntuparamiko18.042.0.0-1ubuntu1.1vulnerable
Ubuntuparamiko18.042.0.0-1ubuntu1.2vulnerable
Ubuntuparamiko18.042.0.0-1ubuntu1.3fixed
Ubuntuparamiko20.042.6.0-1vulnerable
Ubuntuparamiko20.042.6.0-2vulnerable
Ubuntuparamiko20.042.6.0-2ubuntu0.1fixed
Ubuntuparamiko14.041.10.1-1vulnerable
Ubuntuparamiko14.041.10.1-1git1vulnerable
Ubuntuparamiko14.041.10.1-1git1build1vulnerable
Ubuntuparamiko14.041.10.1-1git1ubuntu0.1vulnerable
Ubuntuparamiko14.041.10.1-1git1ubuntu0.2vulnerable
Ubuntuparamikopro1.15.2-1vulnerable
Ubuntuparamikopro1.15.3-1vulnerable
Ubuntuparamikopro1.15.3-1ubuntu1vulnerable
Ubuntuparamikopro1.16.0-1vulnerable
Ubuntuparamikopro1.16.0-1ubuntu0.1vulnerable
Ubuntuparamikopro1.16.0-1ubuntu0.2vulnerable
Ubuntuparamikopro1.16.0-1ubuntu0.2+esm2fixed
Ubuntuparamiko18.042.0.0-1vulnerable
Ubuntuparamiko18.042.0.0-1ubuntu1vulnerable
Ubuntuparamiko18.042.0.0-1ubuntu1.1vulnerable
Ubuntuparamiko18.042.0.0-1ubuntu1.2vulnerable
Ubuntuparamiko18.042.0.0-1ubuntu1.3fixed
Ubuntuparamiko20.042.6.0-1vulnerable
Ubuntuparamiko20.042.6.0-2vulnerable
Ubuntuparamiko20.042.6.0-2ubuntu0.1fixed
Ubuntuparamiko22.042.7.2-1ubuntu1vulnerable
Ubuntuparamiko22.042.8.0-1ubuntu1vulnerable
Ubuntuparamiko22.042.8.1-1ubuntu1vulnerable
Ubuntuparamiko22.042.8.1-1ubuntu2vulnerable
Ubuntuparamiko22.042.8.1-1ubuntu3fixed
Susepython-paramikolinux enterprise module for basesystem 15 sp32.4.2-150100.6.12.1fixed
Susepython-paramikolinux enterprise module for python 2 15 sp32.4.2-150100.6.12.1fixed
Susepython-paramikolinux enterprise real time 15 sp22.4.2-150100.6.12.1fixed
Opensusepython-paramikoleap 15.32.4.2-150100.6.12.1fixed
Opensusepython-paramikoleap 15.42.4.2-150100.6.12.1fixed
Susepython-paramikolinux enterprise module for public cloud 122.4.0-9.13.1fixed
Opensusepython-paramikotumbleweed3.3.1-2.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianparamikosourcesid2.10.3-1not yet assignedNot reported[1008012]
Debianparamikosourceforky2.10.3-1not yet assignedNot reported[1008012]
Debianparamikosourcetrixie2.10.3-1not yet assignedNot reported[1008012]
Debianparamikosourcebookworm2.10.3-1not yet assignedNot reported[1008012]
Opensusepython-paramikorpmtumbleweed5.0.0-1.2Not reportedOPENSUSE-SU-2026:12025-1Not reported
Ubuntuparamikodebpro1.16.0-1ubuntu0.2+esm2Not reportedUSN-5351-2Not reported
Ubuntuparamikodeb18.042.0.0-1ubuntu1.3Not reportedUSN-5351-1Not reported
Ubuntuparamikodeb20.042.6.0-2ubuntu0.1Not reportedUSN-5351-1Not reported
Ubuntuparamikodebpro1.16.0-1ubuntu0.2+esm2Not reportedUBUNTU-CVE-2022-24302Not reported
Ubuntuparamikodeb18.042.0.0-1ubuntu1.3Not reportedUBUNTU-CVE-2022-24302Not reported
Ubuntuparamikodeb20.042.6.0-2ubuntu0.1Not reportedUBUNTU-CVE-2022-24302Not reported
Ubuntuparamikodeb22.042.8.1-1ubuntu3Not reportedUBUNTU-CVE-2022-24302Not reported
Susepython-paramikorpmlinux enterprise module for basesystem 15 sp32.4.2-150100.6.12.1Not reportedSUSE-SU-2022:1446-1Not reported
Susepython-paramikorpmlinux enterprise module for python 2 15 sp32.4.2-150100.6.12.1Not reportedSUSE-SU-2022:1446-1Not reported
Susepython-paramikorpmlinux enterprise real time 15 sp22.4.2-150100.6.12.1Not reportedSUSE-SU-2022:1446-1Not reported
Opensusepython-paramikorpmleap 15.32.4.2-150100.6.12.1Not reportedSUSE-SU-2022:1446-1Not reported
Opensusepython-paramikorpmleap 15.42.4.2-150100.6.12.1Not reportedSUSE-SU-2022:1446-1Not reported
Susepython-paramikorpmlinux enterprise module for public cloud 122.4.0-9.13.1Not reportedSUSE-SU-2022:1447-1Not reported
Opensusepython-paramikorpmtumbleweed3.3.1-2.1Not reportedOPENSUSE-SU-2024:13300-1Not reported

[Debian bug #1008012]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [python313-paramiko]Unknown

    Source package: [python-paramiko]

    Details (1)

    • 5.0.0-1.2 · noarch · tumbleweed

      Unknown · Fixed: 3.3.1-2.1, 5.0.0-1.2

      Version impact unknown

      dsa · python-paramiko · opensuse · tumbleweed

  • [python314-paramiko]Unknown

    Source package: [python-paramiko]

    Details (1)

    • 5.0.0-1.2 · noarch · tumbleweed

      Unknown · Fixed: 3.3.1-2.1, 5.0.0-1.2

      Version impact unknown

      dsa · python-paramiko · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [paramiko-doc]Fixed

    Source package: [paramiko]

    Details (2)

    • 2.12.0-2 · all · bookworm

      Fixed · Fixed: 2.10.3-1

      dsa · paramiko · debian · bookworm

    • 2.12.0-2 · all · bookworm

      Fixed · Fixed: 2.10.3-1

      dsa · paramiko · debian · bookworm

  • [python3-paramiko]Fixed

    Source package: [paramiko]

    Details (2)

    • 2.12.0-2 · all · bookworm

      Fixed · Fixed: 2.10.3-1

      dsa · paramiko · debian · bookworm

    • 2.12.0-2 · all · bookworm

      Fixed · Fixed: 2.10.3-1

      dsa · paramiko · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]