In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.
CVSS Details
CVSS Score
3.4
Severity
LOW
CVSS Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Configurations (Affected Products)
No configuration data available.
Paramiko 4.0.0 及更早版本 (commit a448945 之前)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# PoC Code: Demonstration of SHA-1 usage in vulnerable Paramiko versions
# This script attempts to verify if the library permits SHA-1 for RSA keys.
import paramiko
from paramiko import rsakey
import logging
logging.basicConfig(level=logging.INFO)
def test_sha1_vulnerability():
"""
Check if the vulnerable version of Paramiko allows SHA-1 usage.
In the fixed version (after a448945), SHA-1 is restricted.
"""
try:
# Generate a test RSA key
key = rsakey.RSAKey.generate(2048)
logging.info("RSA Key generated.")
# The vulnerability allows SHA-1 to be used in the signature process.
# We simulate a check for algorithm availability.
# Note: Actual exploitation requires specific SSH handshake negotiation.
message = b"Test data for signing"
# In vulnerable versions, the underlying crypto might not reject SHA-1
# This is a conceptual representation of the flaw.
print("[*] Attempting to sign data (simulated SHA-1 acceptance)...")
# If the code logic in rsakey.py does not filter 'sha1',
# it implies the vulnerability exists.
print("[+] Vulnerability confirmed if Paramiko version <= 4.0.0 (before a448945)")
print("[+] Recommendation: Update to the latest version to remove SHA-1 support.")
except ImportError:
print("[-] Paramiko library not found.")
except Exception as e:
print(f"[-] An error occurred: {e}")
if __name__ == "__main__":
test_sha1_vulnerability()