358 matches found
netdev (>=0.9.1, <=0.9.3), pyplanet (>=0.7.0rc1, <=0.11.12) +2 more potentially affected by CVE-2023-46446 via asyncssh (1.18.0)
asyncssh PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - netdev =0.9.1, =0.7.0rc1, =0.0.1, =0.2.1 Source cves: CVE-2023-46446 Source advisory: OSV:PYSEC-2023-239...
pyplanet (>=0.0.1, <=0.1.4) potentially affected by CVE-2023-46446 via asyncssh (1.9.0)
asyncssh PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.0.1, =0.1.4 Source cves: CVE-2023-46446 Source advisory: OSV:PYSEC-2023-239...
pyplanet (>=0.1.5, <=0.3.3) potentially affected by CVE-2023-46446 via asyncssh (1.10.0)
asyncssh PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.1.5, =0.3.3 Source cves: CVE-2023-46446 Source advisory: OSV:PYSEC-2023-239...
AsyncSSH Security Vulnerability
AsyncSSH is a Python package that provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. A security vulnerability exists in AsyncSSH v2.14.0 and earlier versions, which stems from a vulnerability that allows an attacker to take...
CVE-2023-46446
An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."...
aioasuswrt (>=1.1.20, <=1.3.3), aiosftp (>=0.0.1, <=0.3.0) +40 more potentially affected by CVE-2023-46446 via asyncssh (>=1.9.0, <=2.14.0)
asyncssh PYPI version =1.9.0, =1.1.20, =0.0.1, =0.6.0, =0.3.0, =1.2.1, =2.9.0, =0.4.0, =0.0.4, =0.35.0, =3.1.1, =0.6.5, =0.8.0a7, =2.8.1, =0.1.0, =0.4.54 and more Source cves: CVE-2023-46446 Source advisory: MEND:CVE-2023-46446...
CVE-2023-46445
An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."...
CVE-2023-46446
An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."...
AsyncSSH Data Forgery Issue Vulnerability
AsyncSSH is a Python package that provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. A data forgery issue vulnerability exists in AsyncSSH v2.14.0 and earlier versions, which stems from a vulnerability that allows an attacker to...
aioasuswrt (>=1.1.20, <=1.3.3), aiosftp (>=0.0.1, <=0.3.0) +40 more potentially affected by CVE-2023-46445 via asyncssh (>=1.9.0, <=2.14.0)
asyncssh PYPI version =1.9.0, =1.1.20, =0.0.1, =0.6.0, =0.3.0, =1.2.1, =2.9.0, =0.4.0, =0.0.4, =0.35.0, =3.1.1, =0.6.5, =0.8.0a7, =2.8.1, =0.1.0, =0.4.54 and more Source cves: CVE-2023-46445 Source advisory: MEND:CVE-2023-46445...
CVE-2023-46445
An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."...
CVE-2023-46445: Insufficient Verification of Data Authenticity
An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."...
CVE-2023-46445
An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."...
CVE-2023-46446
An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."...
CVE-2023-46446: Authorization Bypass Through User-Controlled Key
An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."...
CVE-2023-46445
An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."...
CVE-2023-46446
CVE-2023-46446 is confirmed in IBM Storage Ceph (Python AsyncSSH) as a Rogue Session Attack affecting AsyncSSH prior to 2.14.1. IBM’s bulletin ties CVE-2023-46446 to IBM Storage Ceph versions 6.0, 6.1z0-z9, 7.0z0-z1, 7.1z0-z3, and 8.0z0-z3, with the remediation to upgrade to 7.0z2. The advisory n...
CVE-2023-46445
CVE-2023-46445 affects AsyncSSH before 2.14.1, allowing MITM-controlled extension info messages (Rogue Extension Negotiation). IBM Storage Ceph integrations and various Linux distros reference this flaw. Mitigation: upgrade AsyncSSH to 2.14.1 or newer (patching in affected products where applicab...
