Possible leak of key's raw field if declared length is incorrect

TRUNG BÌNH 6.5CVE-2022-31124 · GHSA-hm37-9xh2-q499 · PYSEC-2022-233 · Công bố 06/07/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-31124 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng openssh-key-parser, openssh key parser (openssh key parser project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.3%, cao hơn 71.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.0.6 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
openssh-key-parser PyPI	`< 0.0.6`	`0.0.6`
openssh key parser openssh_key_parser_project	`< 0.0.6`	`0.0.6`

Mô tả

Impact

If a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. An attacker able to modify the declared length of a key's sensitive field can thus expose the raw value of that field.

Patches

Upgrade to version 0.0.6, which no longer includes the raw field value in the error message.

Workarounds

N/A

References

N/A

For more information

If you have any questions or comments about this advisory:

Open an issue in openssh_key_parser

Mô tả của NVD

openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions prior to 0.0.6 if a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. An attacker able to modify the declared length of a key's sensitive field can thus expose the raw value of that field. Users are advised to upgrade to version 0.0.6, which no longer includes the raw field value in the error message. There are no known workarounds for this issue.