PT-2022-20546 · Pypi · Openssh Key Parser

Mike-Arnica · Published 2022-07-06 · Updated 2022-07-14 · CVE-2022-31124

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions openssh key parser versions prior to 0.0.6

Description The openssh key parser package is an open source Python utility for parsing and packing OpenSSH private and public key files. In versions prior to 0.0.6, if a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. An attacker able to modify the declared length of a key's sensitive field can thus expose the raw value of that field.

Recommendations For openssh key parser versions prior to 0.0.6, upgrade to version 0.0.6, which no longer includes the raw field value in the error message. As there are no known workarounds for this issue, upgrading to the latest version is the recommended course of action.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2022-31124

GHSA-HM37-9XH2-Q499

PYSEC-2022-233

Affected Products

Openssh Key Parser

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31124.json · Exploit
• 🔥 https://github.com/scottcwang/openssh_key_parser/pull/5 · Exploit
• https://github.com/scottcwang/openssh_key_parser/commit/26e0a471e9fdb23e635bc3014cf4cbd2323a08d3 · Patch
• https://github.com/scottcwang/openssh_key_parser/commit/d5b53b4b7e76c5b666fc657019dbf864fb04076c · Patch
• https://github.com/scottcwang/openssh_key_parser/commit/274447f91b4037b7050ae634879b657554523b39 · Patch
• https://osv.dev/vulnerability/GHSA-hm37-9xh2-q499 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31124 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-233 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/openssh-key-parser/PYSEC-2022-233.yaml · Note
• https://github.com/scottcwang/openssh_key_parser/security/advisories/GHSA-hm37-9xh2-q499 · Note
• https://github.com/scottcwang/openssh_key_parser · Note
• https://t.me/cibsecurity/45698 · Telegram Post
• https://t.me/cvenotify/32691 · Telegram Post