Pypi · Openssh Key Parser · CVE-2022-31124
**Name of the Vulnerable Software and Affected Versions**
openssh key parser versions prior to 0.0.6
**Description**
The openssh key parser package is an open source Python utility for parsing and packing OpenSSH private and public key files. In versions prior to 0.0.6, if a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. An attacker able to modify the declared length of a key's sensitive field can thus expose the raw value of that field.
**Recommendations**
For openssh key parser versions prior to 0.0.6, upgrade to version 0.0.6, which no longer includes the raw field value in the error message. As there are no known workarounds for this issue, upgrading to the latest version is the recommended course of action.