pitcrew (>=0.0.1, <=0.0.3) potentially affected by unknown CVE via asyncssh (1.16.1)

asyncssh PYPI version 1.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pitcrew =0.0.1, =0.0.3 Source cves: unknown CVE Source advisory: OSV:GHSA-HFMC-7525-MJ55...

pyplanet (>=0.6.0rc1, <=0.6.0) potentially affected by unknown CVE via asyncssh (1.12.2)

asyncssh PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.6.0rc1, =0.6.0 Source cves: unknown CVE Source advisory: OSV:GHSA-HFMC-7525-MJ55...

AsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC

Summary AsyncSSH v2.14.1 and earlier is vulnerable to a novel prefix truncation attack a.k.a. Terrapin attack, which allows a man-in-the-middle attacker to strip an arbitrary number of messages right after the initial key exchange, breaking SSH extension negotiation RFC8308 in the process and thu...

netdev (>=0.9.1, <=0.9.3), pyplanet (>=0.7.0rc1, <=0.11.12) +2 more potentially affected by unknown CVE via asyncssh (1.18.0)

asyncssh PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - netdev =0.9.1, =0.7.0rc1, =0.0.1, =0.2.1 Source cves: unknown CVE Source advisory: OSV:GHSA-HFMC-7525-MJ55...

PT-2023-33026

Name of the Vulnerable Software and Affected Versions AsyncSSH versions 2.14.1 and earlier Description The vulnerability allows a man-in-the-middle attacker to strip an arbitrary number of messages right after the initial key exchange, breaking SSH extension negotiation and downgrading connection...

Fedora: Security Advisory (FEDORA-2023-d2956318e4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 39 : python-asyncssh (2023-d2956318e4)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-d2956318e4 advisory. Security fix for CVE-2023-46446 and CVE-2023-46445 Tenable has extracted the preceding description block directly from the Fedora security advisory...

CVE-2023-46445

A flaw was found in python-asyncssh before 2.14.1 versions, where the rogue extension negotiation process is unauthenticated and allows injecting an info message. This flaw allows an attacker to replace the original message, downgrading the algorithm used for client authentication, which affects...

SUSE CVE-2023-46446

An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."...

DEBIAN-CVE-2023-46445

An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."...

CVE-2023-46445

An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."...

CVE-2023-46446

An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."...

DEBIAN-CVE-2023-46446

An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."...

pyplanet (>=0.5.0, <=0.5.2) potentially affected by CVE-2023-46446 via asyncssh (1.11.0)

asyncssh PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.5.0, =0.5.2 Source cves: CVE-2023-46446 Source advisory: OSV:PYSEC-2023-239...

PYSEC-2023-239

An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation...

pyplanet (>=0.4.0, <=0.4.5) potentially affected by CVE-2023-46446 via asyncssh (1.10.1)

asyncssh PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.4.0, =0.4.5 Source cves: CVE-2023-46446 Source advisory: OSV:PYSEC-2023-239...

Design/Logic Flaw

An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."...

pyplanet (>=0.6.0rc1, <=0.6.0) potentially affected by CVE-2023-46446 via asyncssh (1.12.2)

asyncssh PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.6.0rc1, =0.6.0 Source cves: CVE-2023-46446 Source advisory: OSV:PYSEC-2023-239...

pitcrew (>=0.0.1, <=0.0.3) potentially affected by CVE-2023-46446 via asyncssh (1.16.1)

asyncssh PYPI version 1.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pitcrew =0.0.1, =0.0.3 Source cves: CVE-2023-46446 Source advisory: OSV:PYSEC-2023-239...

pyplanet (>=0.5.3, <=0.5.4) potentially affected by CVE-2023-46446 via asyncssh (1.11.1)

asyncssh PYPI version 1.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.5.3, =0.5.4 Source cves: CVE-2023-46446 Source advisory: OSV:PYSEC-2023-239...