{"action":"Upgrade paramiko to 1.7.2 or later.","affected":[{"fixed":"1.7.2","introduced":"0"}],"component":"paramiko","cve_ids":["CVE-2008-0299"],"ecosystem":"PyPI","epss":0.0162,"exploited":false,"fixed_versions":["1.7.2"],"ghsa_id":"GHSA-wqmm-q65g-2hqr","id":"tcs_01M5KG55DG9RNGDQ9KX5BB1RVX","modified_at":"2026-06-10T17:02:28.904814896Z","published_at":"2008-01-16T23:00:00Z","references":["https://osv.dev/vulnerability/PYSEC-2008-8","http://people.debian.org/~nion/nmu-diff/paramiko-1.6.4-1_1.6.4-1.1.patch","http://www.lag.net/pipermail/paramiko/2008-January/000599.html","https://bugzilla.redhat.com/show_bug.cgi?id=428727","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=460706","https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00529.html","https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00594.html","http://www.securityfocus.com/bid/27307","http://secunia.com/advisories/28488","http://secunia.com/advisories/28510","http://security.gentoo.org/glsa/glsa-200803-07.xml","http://secunia.com/advisories/29168","https://exchange.xforce.ibmcloud.com/vulnerabilities/39749","https://github.com/advisories/GHSA-wqmm-q65g-2hqr"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2008-8","url":"https://osv.dev/vulnerability/PYSEC-2008-8"}],"summary":"common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by pred"}