Race Condition Affecting parallel-ssh package, versions [,2.9.1)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Race Condition vulnerabilities in an interactive lesson.

Start learning

Snyk IDSNYK-PYTHON-PARALLELSSH-8688146
published5 Feb 2025
disclosed1 Feb 2025
creditUnknown

Report a new vulnerability Found a mistake?

Introduced: 1 Feb 2025

NewCWE-362 (opens in a new tab)

How to fix?

Upgrade parallel-ssh to version 2.9.1 or higher.

Overview

parallel-ssh is an Asynchronous parallel SSH library

Affected versions of this package are vulnerable to Race Condition in the scp_send function, leading to incomplete file transfers without error notifications.

References

CVSS Scores

version 4.0

version 3.1

Attack Vector (AV)
Network
Attack Complexity (AC)
Low
Attack Requirements (AT)
Present
Privileges Required (PR)
None
User Interaction (UI)
None

Confidentiality (VC)
Low
Integrity (VI)
None
Availability (VA)
High

Confidentiality (SC)
None
Integrity (SI)
None
Availability (SA)
None