Bug 2466929 (CVE-2026-44405)

Summary: CVE-2026-44405 paramiko: Paramiko: Data integrity could be compromised due to SHA-1 algorithm use
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: anthomas, brasmith, cochase, dfreiber, dranck, drow, dschmidt, dymurray, eglynn, ehelms, erezende, ggainey, ibolton, jburrell, jjoyce, jkoehler, jlanda, jmatthew, jmontleo, jpretori, jschluet, juwatts, kshier, lhh, ljawale, lphiri, luizcosta, mburns, mgarciac, mhulan, nmoumoul, nweather, osousa, pcreech, pgaikwad, rbobbitt, rchan, rhel-process-autobot, rjohnson, simaishi, slucidi, smallamp, smcdonal, sseago, stcannon, teagle, tmalecek, vkumar, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Paramiko, a Python implementation of the SSHv2 protocol. The `rsakey.py` module allows the use of the SHA-1 cryptographic hash algorithm, which is known to have security weaknesses. An attacker on the same local network, with significant effort, could potentially exploit this to achieve a limited compromise of data integrity.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-06 01:02:11 UTC
In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.