Fluid Attacks Database

Description

An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	python-asyncssh	=2.5.0-0.1 \|\| >=0 <2.5.0-0.1+deb11u1	2.5.0-0.1+deb11u1
debian 12	python-asyncssh	=2.10.1-2 \|\| =2.10.1-2+deb12u1 \|\| >=0 <2.10.1-2+deb12u2	2.10.1-2+deb12u2
debian 13	python-asyncssh	>=0 <2.15.0-1	2.15.0-1
debian 14	python-asyncssh	>=0 <2.15.0-1	2.15.0-1
pypi	asyncssh	>=0 <2.14.1	2.14.1

Aliases

1. CVE-2023-464462. NVD-2023-464463. OSV-DEBIAN-2023-464464. OSV-2023-464465. GHSA-c35q-ffpf-5qpm6. GCVE-2023-464467. SECURITY-TRACKER-CVE-2023-464468. lists.debian.org

References

1. https://github.com/ronf/asyncssh/security/advisories/GHSA-c35q-ffpf-5qpm2. https://github.com/ronf/asyncssh/commit/83e43f5ea3470a8617fc388c72b062c7136efd7e3. https://github.com/pypa/advisory-database/tree/main/vulns/asyncssh/PYSEC-2023-239.yaml4. https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst5. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ME34ROZWMDK5KLMZKTSA422XVJZ7IMTE6. https://security.netapp.com/advisory/ntap-20231222-00017. https://www.terrapin-attack.com8. http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.