CVE-2022-31124: openssh-key-parser - Possible leak of key's raw field if declared length is incorrect
Summary
CVE-2022-31124: Possible leak of key's raw field if declared length is incorrect. Affects openssh-key-parser versions < 0.0.6. Fixed in 0.0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The openssh-key-parser package is a Python library that allows parsing and manipulation of OpenSSH key files. It provides functionality to read and extract information from OpenSSH key files, such as public and private keys. The package is commonly used in Python applications that need to work with OpenSSH keys. However, a vulnerability has been discovered in versions prior to 0.0.6 that could lead to a possible leak of a key's raw field if the declared length is incorrect.
Vulnerability Detail
The vulnerability arises when a field of a key is shorter than it is declared to be. In such cases, the parser raises an error with a message that includes the raw field value. An attacker who can modify the declared length of a key's sensitive field can exploit this behavior to expose the raw value of that field. This could potentially lead to unauthorized access or other security breaches. The vulnerability has a CVSS score of 7.7, indicating a high severity level.
How To Fix
Latest published version: 0.0.7 as of 22 Oct 2026
pip install --upgrade "openssh-key-parser==0.0.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.6
This is the first release that contains the fix.
pip install --upgrade "openssh-key-parser==0.0.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to upgrade to the fixed version to address the issue.
Conclusion
The openssh-key-parser package prior to version 0.0.6 is vulnerable to a possible leak of a key's raw field if the declared length is incorrect. It is crucial to upgrade to the fixed version to mitigate the risk of exposing sensitive information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openssh-key-parser →
FAQ
openssh-key-parser is a Python library for parsing and manipulating OpenSSH key files.
The vulnerability can potentially expose the raw value of a key's sensitive field, leading to unauthorized access or other security breaches.
To fix this vulnerability, upgrade to version 0.0.6 of the openssh-key-parser package.
No, there are no known workarounds for this vulnerability.
For more information, you can open an issue in the openssh-key-parser GitHub repository.
