CVE-2008-0299: Paramiko common.py Information Disclosure
Summary
CVE-2008-0299: common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of... Affects paramiko versions < 1.7.2. Fixed in 1.7.2. How to fix ↓
Also tracked for
- paramiko · Debian:11
The same CVE-2008-0299 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Paramiko is a Python implementation of the SSHv2 protocol, providing both client and server functionality. It is widely used for secure remote access and automation tasks. The vulnerability affects Paramiko versions 1.7.1 and earlier, specifically when using threads or forked processes. The RandomPool in common.py is not properly utilized, allowing one session to predict the state of the pool and obtain sensitive information from another session.
Vulnerability Detail
The vulnerability in Paramiko's common.py arises from the improper use of RandomPool. When multiple sessions are running concurrently, an attacker can exploit this flaw to predict the state of the pool and retrieve sensitive information from another session. This can lead to unauthorized access, data leakage, and potential compromise of the SSH connection. The vulnerability was assigned CVE-2008-0299.
How To Fix
Latest published version: 5.1.0 as of 23 Oct 2026
pip install --upgrade "paramiko==5.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.2
This is the first release that contains the fix.
pip install --upgrade "paramiko==1.7.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in Paramiko's common.py can be mitigated by upgrading to version 1.7.2 or later. This will ensure the proper utilization of RandomPool and prevent information disclosure between sessions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for paramiko →
FAQ
Paramiko is a Python implementation of the SSHv2 protocol, providing secure remote access and automation capabilities.
Paramiko versions 1.7.1 and earlier are affected by this vulnerability.
The vulnerability allows one session to obtain sensitive information from another session, potentially leading to unauthorized access and data leakage.
To fix this vulnerability, upgrade Paramiko to version 1.7.2 or later.
No specific workaround has been provided for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for paramiko.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
