VulnerabilityModified
CVE-2023-46445
An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."
MEDIUM 5.9EPSS 0.59%
Does this matter?
Lower severity and a low EPSS score (0.59%). Track it; it rarely justifies an emergency change on its own.
Description
An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 0.59% probability · 46th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-345
- Affected
- asyncssh project/asyncssh
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html
- https://github.com/advisories/GHSA-cfc2-wr2v-gxm5
- https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst
- https://github.com/ronf/asyncssh/security/advisories/GHSA-cfc2-wr2v-gxm5Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ME34ROZWMDK5KLMZKTSA422XVJZ7IMTE/
- https://security.netapp.com/advisory/ntap-20231222-0001/
- https://www.terrapin-attack.com
- http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html
- https://github.com/advisories/GHSA-cfc2-wr2v-gxm5
- https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst
- https://github.com/ronf/asyncssh/security/advisories/GHSA-cfc2-wr2v-gxm5Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/09/msg00042.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ME34ROZWMDK5KLMZKTSA422XVJZ7IMTE/
- https://security.netapp.com/advisory/ntap-20231222-0001/
- https://www.terrapin-attack.com
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.