CVE-2022-31124: openssh-key-parser - Exposing Raw Field Value Vulnerability
Summary
CVE-2022-31124: openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. Affects openssh-key-parser across 4 version ranges.
< 0.0.6
< 26e0a471e9fdb23e635bc3014cf4cbd2323a08d3
< 274447f91b4037b7050ae634879b657554523b39
< d5b53b4b7e76c5b666fc657019dbf864fb04076c
Fixed in d5b53b4b7e76c5b666fc657019dbf864fb04076c. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
openssh-key-parser is a Python package that provides utilities to parse and pack OpenSSH private and public key files. It is commonly used for handling SSH keys in Python applications. The package allows users to read and manipulate OpenSSH key files, which are used for authentication in SSH connections. This vulnerability affects versions prior to 0.0.6 of openssh-key-parser.
Vulnerability Detail
In versions prior to 0.0.6, openssh-key-parser has a vulnerability where if a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. This means that an attacker who can modify the declared length of a key's sensitive field can expose the raw value of that field. This vulnerability can potentially lead to the exposure of sensitive information, such as private key material. Users are advised to upgrade to version 0.0.6, which no longer includes the raw field value in the error message.
How To Fix
Latest published version: 0.0.7 as of 22 Oct 2026
pip install --upgrade "openssh-key-parser==0.0.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
d5b53b4b7e76c5b666fc657019dbf864fb04076c
This is the first release that contains the fix.
pip install --upgrade "openssh-key-parser==d5b53b4b7e76c5b666fc657019dbf864fb04076c"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The openssh-key-parser package prior to version 0.0.6 is vulnerable to an issue where an attacker can expose the raw value of a key's sensitive field by modifying the declared length of the field. This can lead to the exposure of sensitive information. Users should upgrade to version 0.0.6 to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openssh-key-parser →
FAQ
openssh-key-parser is a Python package used for parsing and packing OpenSSH private and public key files. It provides utilities for working with SSH keys in Python applications.
This vulnerability allows an attacker to expose the raw value of a key's sensitive field if they can modify the declared length of the field. This can potentially lead to the exposure of sensitive information, such as private key material.
Versions prior to 0.0.6 of openssh-key-parser are affected by this vulnerability.
There are no known workarounds for this vulnerability. Users are advised to upgrade to version 0.0.6 of openssh-key-parser.
To upgrade openssh-key-parser to version 0.0.6, you can use the following command: pip install --upgrade openssh-key-parser==0.0.6
