Duplicity versions prior to 3.1.0_2 use Paramiko's rsakey.py module which allows the use of the SHA-1 algorithm. This cryptographic choice is considered weak and deprecated. The vulnerability has a low CVSS score and does not impact confidentiality or availability but may allow limited integrity issues. A fix is available in version 3.1.0_2.