Fluid Attacks Database

Description

An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 12	python-asyncssh	=2.10.1-2 \|\| =2.10.1-2+deb12u1 \|\| >=0 <2.10.1-2+deb12u2	2.10.1-2+deb12u2
debian 11	python-asyncssh	=2.5.0-0.1 \|\| >=0 <2.5.0-0.1+deb11u1	2.5.0-0.1+deb11u1
debian 13	python-asyncssh	>=0 <2.15.0-1	2.15.0-1
debian 14	python-asyncssh	>=0 <2.15.0-1	2.15.0-1
pypi	asyncssh	>=0 <2.14.1	2.14.1

Aliases

1. CVE-2023-464452. NVD-2023-464453. OSV-DEBIAN-2023-464454. OSV-2023-464455. GHSA-cfc2-wr2v-gxm56. GCVE-2023-464457. SECURITY-TRACKER-CVE-2023-464458. lists.debian.org

References

1. https://github.com/ronf/asyncssh/security/advisories/GHSA-cfc2-wr2v-gxm52. https://github.com/ronf/asyncssh/commit/83e43f5ea3470a8617fc388c72b062c7136efd7e3. https://github.com/pypa/advisory-database/tree/main/vulns/asyncssh/PYSEC-2023-237.yaml4. https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst5. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ME34ROZWMDK5KLMZKTSA422XVJZ7IMTE6. https://security.netapp.com/advisory/ntap-20231222-00017. https://www.terrapin-attack.com8. http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.