CVE-2026-44405 Paramiko允许使用SHA-1算法漏洞

# PoC Code: Demonstration of SHA-1 usage in vulnerable Paramiko versions # This script attempts to verify if the library permits SHA-1 for RSA keys. import paramiko from paramiko import rsakey import logging logging.basicConfig(level=logging.INFO) def test_sha1_vulnerability(): """ Check if the vulnerable version of Paramiko allows SHA-1 usage. In the fixed version (after a448945), SHA-1 is restricted. """ try: # Generate a test RSA key key = rsakey.RSAKey.generate(2048) logging.info("RSA Key generated.") # The vulnerability allows SHA-1 to be used in the signature process. # We simulate a check for algorithm availability. # Note: Actual exploitation requires specific SSH handshake negotiation. message = b"Test data for signing" # In vulnerable versions, the underlying crypto might not reject SHA-1 # This is a conceptual representation of the flaw. print("[*] Attempting to sign data (simulated SHA-1 acceptance)...") # If the code logic in rsakey.py does not filter 'sha1', # it implies the vulnerability exists. print("[+] Vulnerability confirmed if Paramiko version <= 4.0.0 (before a448945)") print("[+] Recommendation: Update to the latest version to remove SHA-1 support.") except ImportError: print("[-] Paramiko library not found.") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": test_sha1_vulnerability()