CVE-2022-24302: Paramiko Race Condition Information Disclosure
Summary
CVE-2022-24302: In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. Affects paramiko across 2 version ranges.
< 2.9.3
>= 2.10.0, < 2.10.1
Fixed in 2.9.3 or 2.10.1, depending on the release line you run. How to fix ↓
Also tracked for
- paramiko · Debian:11
The same CVE-2022-24302 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Paramiko is a Python implementation of the SSHv2 protocol, providing both client and server functionality. It is widely used for secure remote connections and file transfers. The vulnerability in Paramiko before version 2.10.1 is due to a race condition in the write_private_key_file function. This race condition occurs between the creation and chmod of a private key file, potentially leading to unauthorized information disclosure.
Vulnerability Detail
The race condition in the write_private_key_file function of Paramiko allows an attacker to gain unauthorized access to sensitive information. By exploiting this vulnerability, an attacker could potentially read the contents of private key files, which may contain sensitive data such as cryptographic keys. This could lead to further compromise of the affected system or unauthorized access to other systems if the compromised keys are used for authentication.
How To Fix
Latest published version: 5.1.0 as of 23 Oct 2026
pip install --upgrade "paramiko==5.1.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.9.32.9.3pip install --upgrade "paramiko==2.9.3" -
>= 2.10.0, < 2.10.12.10.1pip install --upgrade "paramiko==2.10.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Paramiko is not immediately feasible, a possible workaround is to manually set the correct permissions for the private key files after they are created. This can be done using the chmod command in a secure manner. For example:
chmod 600 private_key.pem
Conclusion
The race condition vulnerability in Paramiko before version 2.10.1 can lead to unauthorized information disclosure, potentially exposing sensitive data. It is crucial to upgrade Paramiko to the latest version or apply the recommended workaround to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for paramiko →
FAQ
Paramiko is a Python implementation of the SSHv2 protocol, providing secure remote connections and file transfers.
This vulnerability allows unauthorized information disclosure, potentially exposing sensitive data such as private keys.
Upgrade Paramiko to version 2.10.1 or later using the 'pip install --upgrade paramiko' command.
If upgrading is not immediately feasible, manually setting the correct permissions for private key files can serve as a temporary workaround.
There is no known exploit at the time of this report, but it is important to patch the vulnerability as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for paramiko.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
