[SUPPORT] - Allowing running CVE-2018-15473 again

Hey dev's!

Are you using paramiko as a client or server?

Client

What feature(s) aren't working right?

SSH

What version(s) of paramiko are you using?

3.4.1

What version(s) of Python are you using?

3.12.5

What operating system and version are you using?

Ubuntu 22

If you're connecting as a client, which SSH server are you connecting to?

No response

If you're using paramiko as part of another tool, which tool/version?

No response

What are you trying to do with paramiko?

Back in 2018, OpenSSH < 7.7 was vulnerable to user enumeration because of a race condition involving public key authentication. A POC was released allowing to monkeypatch paramiko, https://github.com/epi052/cve-2018-15473/blob/master/ssh-username-enum.py.

Few functions are patched, especially the followings:

# Messages which should be handled _by_ servers (sent by clients)
    @property
    def _server_handler_table(self):
        return {
            # TODO 4.0: MSG_SERVICE_REQUEST ought to eventually move into
            # Transport's server mode like the client side did, just for
            # consistency.
            MSG_SERVICE_REQUEST: self._parse_service_request,
            MSG_USERAUTH_REQUEST: self._parse_userauth_request,
            MSG_USERAUTH_INFO_RESPONSE: self._parse_userauth_info_response,
        }

    # Messages which should be handled _by_ clients (sent by servers)
    @property
    def _client_handler_table(self):
        return {
            MSG_SERVICE_ACCEPT: self._parse_service_accept,
            MSG_USERAUTH_SUCCESS: self._parse_userauth_success,
            MSG_USERAUTH_FAILURE: self._parse_userauth_failure,
            MSG_USERAUTH_BANNER: self._parse_userauth_banner,
            MSG_USERAUTH_INFO_REQUEST: self._parse_userauth_info_request,
        }

    # NOTE: prior to the fix for #1283, this was a static dict instead of a
    # property. Should be backwards compatible in most/all cases.
    @property
    def _handler_table(self):
        if self.transport.server_mode:
            return self._server_handler_table
        else:
            return self._client_handler_table

And yes, prior to the fix for #1283 it was possible to modify the dict which is not the case anymore. IT IS backward compatible for standard usages but when trying to test the race condition it is not. Or at least I didn't find a way of monkey patching the code.

Is there a way we can re-create the poc using the latest version of Paramiko ? Or may be you guys don't want to deal with such a niche use case, which I completely understand ? Let me know :D!

How are you trying to do it, and what's happening instead?

Poc for CVE-2018-15473 is not working anymore on latest paramiko version.

Anything else?

No response

Start by reviewing the cited Transport handler-table properties, the change referenced as #1283, and the linked cve-2018-15473 proof of concept. Determine whether current Paramiko behavior can support this monkeypatching use case and define what compatibility or documentation outcome would count as done.