Possible leak of key's raw field if declared length is incorrect

中 6.5CVE-2022-31124 · GHSA-hm37-9xh2-q499 · PYSEC-2022-233 · 06/07/2022 公開 · 17/06/2026 更新

要点

CVE-2022-31124 は openssh-key-parser, openssh key parser (openssh key parser project) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.3%（全脆弱性の 71.3% より高い）。
対処：0.0.6 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
openssh-key-parser PyPI	`< 0.0.6`	`0.0.6`
openssh key parser openssh_key_parser_project	`< 0.0.6`	`0.0.6`

概要

Impact

If a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. An attacker able to modify the declared length of a key's sensitive field can thus expose the raw value of that field.

Patches

Upgrade to version 0.0.6, which no longer includes the raw field value in the error message.

Workarounds

N/A

References

N/A

For more information

If you have any questions or comments about this advisory:

Open an issue in openssh_key_parser

NVD の説明

openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions prior to 0.0.6 if a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. An attacker able to modify the declared length of a key's sensitive field can thus expose the raw value of that field. Users are advised to upgrade to version 0.0.6, which no longer includes the raw field value in the error message. There are no known workarounds for this issue.