Paramiko, up to version 4.0.0 before the commit identified as a448945, includes code in rsakey.py that allows use of the SHA‑1 algorithm for RSA key handling. This weakness permits the use of an outdated hash function, undermining the strength of digitally signed operations. If an application relies on Paramiko for authentication or key verification, attackers could exploit the weaker SHA‑1 to forge signatures, potentially allowing unauthorized access or tampering. The CVE impact is limited to integrity and authenticity concerns rather than direct code execution.

The affected product is Paramiko. All releases prior to version 4.0.0 released before the commit a448945 are impacted, including any distributions or applications that embed those versions.

The CVSS score of 3.4 indicates low risk. The EPSS score of < 1 % suggests a very low probability of exploitation, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation. This weakness is typical of static cryptographic libraries and may be exploitable if the application accepts parametrized RSA keys. Based on the description, it is inferred that attackers would need to supply RSA keys that use SHA‑1, so the attack vector is likely through application usage of Paramiko for key processing or authentication.