MaccaroniC2

MaccaroniC2 - 使用AsyncSSH赋能命令与控制 MaccaroniC2 是一个 概念验证 的命令与控制框架 ，它利用了强大的 AsyncSSH Python 库，该库提供了 SSHv2 协议的异步客户端和服务器实现，并使用 PyNgrok 封装来集成 ngrok。此工具针对一个特定场景设计：受害者在受控机器上运行 AsyncSSH 服务器并建立到外部的隧道，等待攻击者发送命令。 攻击者利用 Ngrok 官方 API 获取隧道的主机名和端口以建立连接。这种方法充分利用了 AsyncSSH 提供的全面能力，包括对 SFTP 和 SCP...

AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

SummaryA malicious SSH server can wedge an AsyncSSH client, and an authenticatedclient can wedge an AsyncSSH server, by sending a channel maximum packetsize of 0 in SSHMSGCHANNELOPENCONFIRMATION server→client orSSHMSGCHANNELOPEN client→server. AsyncSSH stores the peer-supplied valueverbatim with ...

openSUSE 16 Security Update : python-asyncssh (openSUSE-SU-2026:21953-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21953-1 advisory. Changes in python-asyncssh: - CVE-2026-62949: denial of service via infinite loop when processing zero-sized SSH packets bsc1280972 Tenable has extracte...

CLEANSTART-2026-KI90686 AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework

CVE-2026-62949 affects multiple packages. AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. See references for individual vulnerability details...

OPENSUSE-SU-2026:21953-1 Security update for python-asyncssh

This update for python-asyncssh fixes the following issues: Changes in python-asyncssh: - CVE-2026-62949: denial of service via infinite loop when processing zero-sized SSH packets bsc1280972...

OPENSUSE-SU-2026:11851-1 python313-asyncssh-2.24.0-1.1 on GA media

These are all security issues fixed in the python313-asyncssh-2.24.0-1.1 package on the GA media of openSUSE Tumbleweed...

Linux Distros Unpatched Vulnerability : CVE-2026-62949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior...

GHSA-RW4J-R22C-9GC3 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

Summary A malicious SSH server can wedge an AsyncSSH client, and an authenticated client can wedge an AsyncSSH server, by sending a channel maximum packet size of 0 in SSHMSGCHANNELOPENCONFIRMATION server→client or SSHMSGCHANNELOPEN client→server. AsyncSSH stores the peer-supplied value verbatim...

EUVD-2026-81093

AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSHMSGCHANNELOPEN / OPENCONFIRMATION...

AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

Summary A malicious SSH server can wedge an AsyncSSH client, and an authenticated client can wedge an AsyncSSH server, by sending a channel maximum packet size of 0 in SSHMSGCHANNELOPENCONFIRMATION server→client or SSHMSGCHANNELOPEN client→server. AsyncSSH stores the peer-supplied value verbatim...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in the SSHMSGCHANNELOPEN and SSHMSGCHANNELOPENCONFIRMATION. An attacker can cause the asyncio event loop to freeze by supplying a sendpktsize value of zero, which leads to an infinite loop that prevents further processing ...

CVE-2026-62949

A flaw was found in AsyncSSH, a Python package for SSHv2 protocol implementation. A malicious SSH server or an authenticated client can exploit this vulnerability by sending a specially crafted SSH packet with a zero-sized maximum packet size. This can cause the AsyncSSH event loop to freeze,...

DEBIAN-CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

UBUNTU-CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949

CVE-2026-62949 affects AsyncSSH , a Python asynchronous SSHv2 implementation. The flaw resides in _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py, which accept a peer-supplied send_pktsize value of zero . When channel data reaches SSHChannel._flush_send_buf,...