CVE-2023-46446
6.8 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
6.4 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
36.8%
An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a “Rogue Session Attack.”
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| asyncssh_project:asyncssh | asyncssh project asyncssh | lt | 2.14.1 |
References
packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html
github.com/advisories/GHSA-c35q-ffpf-5qpm
github.com/ronf/asyncssh/blob/develop/docs/changes.rst
github.com/ronf/asyncssh/security/advisories/GHSA-c35q-ffpf-5qpm
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ME34ROZWMDK5KLMZKTSA422XVJZ7IMTE/
security.netapp.com/advisory/ntap-20231222-0001/
www.terrapin-attack.com
Social References
More
Related
6.8 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
6.4 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
36.8%