Information disclosure in OpenSSH Key Parser Project
CVE-2022-31124
openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions prior to 0.0.6 if a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. An attacker able to modify the declared length of a key's sensitive field can thus expose the raw value of that field. Users are advised to upgrade to version 0.0.6, which no longer includes the raw field value in the error message. There are no known workarounds for this issue.
EPSS: 0.013 (66.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Openssh_key_parser_project Openssh_key_parser
- Scottcwang Openssh_key_parser — versions < 0.0.6
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Exploit, Third Party Advisory, x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-31124?
- CVE-2022-31124 is a high-severity vulnerability in OpenSSH Key Parser Project, classified under Generation of Error Message Containing Sensitive Information. CVSS score: 7.7/10. Published 2022-07-06.
- How severe is CVE-2022-31124?
- High severity. CVSS v3 base score is 7.7 out of 10.
- Is CVE-2022-31124 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.