Paramiko: Information disclosure

Background

Paramiko is a Secure Shell Server implementation written in Python.

Description

Dwayne C. Litzenberger reported that the file “common.py” does not properly use RandomPool when using threads or forked processes.

Impact

A remote attacker could predict the values generated by applications using Paramiko for encryption purposes, potentially gaining access to sensitive information.

Workaround

There is no known workaround at this time.

Resolution

All Paramiko users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=dev-python/paramiko-1.7.2"