VulnerabilityModified
CVE-2023-46446
An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."
MEDIUM 6.8EPSS 0.87%
Does this matter?
Lower severity and a low EPSS score (0.87%). Track it; it rarely justifies an emergency change on its own.
Description
An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."
- CVSS 3.1
- 6.8 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 0.87% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-639
- Affected
- asyncssh project/asyncssh
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html
- https://github.com/advisories/GHSA-c35q-ffpf-5qpm
- https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst
- https://github.com/ronf/asyncssh/security/advisories/GHSA-c35q-ffpf-5qpmThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ME34ROZWMDK5KLMZKTSA422XVJZ7IMTE/
- https://security.netapp.com/advisory/ntap-20231222-0001/
- https://www.terrapin-attack.com
- http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html
- https://github.com/advisories/GHSA-c35q-ffpf-5qpm
- https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst
- https://github.com/ronf/asyncssh/security/advisories/GHSA-c35q-ffpf-5qpmThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/09/msg00042.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ME34ROZWMDK5KLMZKTSA422XVJZ7IMTE/
- https://security.netapp.com/advisory/ntap-20231222-0001/
- https://www.terrapin-attack.com
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.