CVSS 3.1
6.8 mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NCVE-2023-46446
Medium (6.8) in asyncssh project asyncssh. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in asyncssh 2.14.1.
An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
- CWE
- CWE-639
- Published
- Modified
- Record from
- the NVD, synced
Affected
- asyncssh_project:asyncssh
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c35q-ffpf-5qpm | PyPI | asyncssh | <2.14.1 | 2.14.1 |
| PYSEC-2023-239 | PyPI | asyncssh | <2.14.1 | 2.14.1 |
References
- http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html
- https://github.com/advisories/GHSA-c35q-ffpf-5qpm
- https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst
- https://github.com/ronf/asyncssh/security/advisories/GHSA-c35q-ffpf-5qpm
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ME34ROZWMDK5KLMZKTSA422XVJZ7IMTE/