CVE-2023-46446
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
14/11/2023
Last modified:
22/12/2023
Description
An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."
Impact
Base Score 3.x
6.80
Severity 3.x
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:asyncssh_project:asyncssh:*:*:*:*:*:*:*:* | 2.14.1 (excluding) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html
- https://github.com/advisories/GHSA-c35q-ffpf-5qpm
- https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst
- https://github.com/ronf/asyncssh/security/advisories/GHSA-c35q-ffpf-5qpm
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ME34ROZWMDK5KLMZKTSA422XVJZ7IMTE/
- https://security.netapp.com/advisory/ntap-20231222-0001/
- https://www.terrapin-attack.com