[Bug 1973241] Re: Paramiko 2.9.0 breaks compatibility with devices only supporting ssh-rsa and not supporting server-sig-algs

[Bug Watch Updater]

** Changed in: paramiko
       Status: Unknown => New

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to paramiko in Ubuntu.
https://bugs.launchpad.net/bugs/1973241

Title:
  Paramiko 2.9.0 breaks compatibility with devices only supporting ssh-
  rsa and not supporting server-sig-algs

Status in paramiko:
  New
Status in paramiko package in Ubuntu:
  New
Status in paramiko source package in Jammy:
  New
Status in paramiko source package in Kinetic:
  New

Bug description:
  [impact]

  paramiko fails to connect to some servers.

  [test case]

  attempt to connect to a server that does not support server-sig-algs
  and also only supports ssh-rsa (specifically, does not support rsa-
  sha2-512). the connection will fail:

  DEBUG:paramiko.transport:Finalizing pubkey algorithm for key of type 'ssh-rsa'
  DEBUG:paramiko.transport:Our pubkey algorithm list: ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-rsa']
  DEBUG:paramiko.transport:Server did not send a server-sig-algs list; defaulting to our first preferred algo ('rsa-sha2-512')
  DEBUG:paramiko.transport:NOTE: you may use the 'disabled_algorithms' SSHClient/Transport init kwarg to disable that or other algorithms if your server does not support them!
  INFO:paramiko.transport:Authentication (publickey) failed.
  Traceback (most recent call last):
    File "<stdin>", line 1, in <module>
    File "/usr/lib/python3/dist-packages/paramiko/client.py", line 435, in connect
      self._auth(
    File "/usr/lib/python3/dist-packages/paramiko/client.py", line 766, in _auth
      raise saved_exception
    File "/usr/lib/python3/dist-packages/paramiko/client.py", line 736, in _auth
      key = self._key_from_filepath(
    File "/usr/lib/python3/dist-packages/paramiko/client.py", line 588, in _key_from_filepath
      key = klass.from_private_key_file(key_path, password)
    File "/usr/lib/python3/dist-packages/paramiko/pkey.py", line 249, in from_private_key_file
      key = cls(filename=filename, password=password)
    File "/usr/lib/python3/dist-packages/paramiko/rsakey.py", line 64, in __init__
      self._from_private_key_file(filename, password)
    File "/usr/lib/python3/dist-packages/paramiko/rsakey.py", line 190, in _from_private_key_file
      data = self._read_private_key_file("RSA", filename, password)
    File "/usr/lib/python3/dist-packages/paramiko/pkey.py", line 322, in _read_private_key_file
      data = self._read_private_key(tag, f, password)
    File "/usr/lib/python3/dist-packages/paramiko/pkey.py", line 351, in _read_private_key
      data = self._read_private_key_openssh(lines[start:end], password)
    File "/usr/lib/python3/dist-packages/paramiko/pkey.py", line 452, in _read_private_key_openssh
      raise PasswordRequiredException(
  paramiko.ssh_exception.PasswordRequiredException: private key file is encrypted

  [regression potential]

  any regression would likely prevent paramiko from connecting to a
  remote server.

  [scope]

  this needs to be fixed in jammy and later.

  this problem was introduced in paramiko 2.9.0 so does not exist in
  impish or earlier.

  [other info]

  this doesn't appear to be fixed upstream yet.
  https://github.com/paramiko/paramiko/issues/2012

  Note this can be worked around if direct access to the paramiko code
  is possible, by using the 'disabled_algorithms' parameter to the
  client connect() method, e.g.:

  client.connect("<hostname>", disabled_algorithms={'pubkeys': ['rsa-
  sha2-256', 'rsa-sha2-512']})

  Note this can break connections to other systems however, that do
  support (only) those algs, so is not a very good workaround.
  Additionally, this workaround isn't even possible if paramiko is being
  used internally by some other python application.

To manage notifications about this bug go to:
https://bugs.launchpad.net/paramiko/+bug/1973241/+subscriptions