8 matches found
CLEANSTART-2026-WV96741 Security fix for CVE-2026-45309 applied in: airflow-2 2.11.2-r2, airflow-3 3.1.8-r3, airflow-3 3.2.0-r0
CVE-2026-45309 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution
Incomplete fix for CVE-2026-45309 GHSA-g794-3fmp-753h. The 2.23.0 guard that sanitises the SSH username before %u substitution in AuthorizedKeysFile blocks /, \ and .., but does not block a leading or $ENV, both of which are re-introduced by later expansion and reach the file open — defeating the...
DEBIAN-CVE-2026-45309
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py,...
Linux Distros Unpatched Vulnerability : CVE-2026-45309
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior...
DEBIAN-CVE-2026-54590
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig.settokens that blocks /, , and .. before %u substitution in...
UBUNTU-CVE-2026-54590
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig.settokens that blocks /, , and .. before %u substitution in...
PT-2026-56577
Name of the Vulnerable Software and Affected Versions AsyncSSH version 2.23.0 Description An incomplete fix in the SSHServerConfig. set tokens function fails to block leading or $ENV characters before %u substitution in the AuthorizedKeysFile. This allows subsequent expansion in expand val and...
