Paramiko, up to version 4.0.0 before the commit identified as a448945, includes code in rsakey.py that allows use of the SHA‑1 algorithm for RSA key handling. This weakness permits the use of an outdated hash function, undermining the strength of digitally signed operations. If an application relies on Paramiko for authentication or key verification, attackers could exploit the weaker SHA‑1 to forge signatures, potentially allowing unauthorized access or tampering. The CVE impact is limited to integrity and authenticity concerns rather than direct code execution.

The affected product is Paramiko. All releases prior to version 4.0.0 released before the commit a448945 are impacted, including any distributions or applications that embed those versions.

The CVSS score of 3.4 indicates low risk. EPSS data is not available, so exploitation likelihood cannot be quantified exactly, but the vulnerability is typical of static cryptographic libraries and may be exploitable if the application accepts parametrized RSA keys. The vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation. Based on the description, it is inferred that attackers would need to supply RSA keys that rely on SHA‑1; thus the attack vector is likely through application usage of Paramiko for key processing or authentication.