Rogue Extension Negotiation

asyncssh is vulnerable to Rogue Extension Negotiation. The vulnerability is caused by an implementation flaw in the AsyncSSH server implementation which leads to an injection of an extension info message chosen by the attacker via a man-in-the-middle attack. This is achieved by downgrading the...

Rogue Session

asyncssh is vulnerable to a Rogue Session. The vulnerability is caused by a state machine flaw in the the AsyncSSH server while authenticating a client in which results in the client being forced to to log into the attacker's account without the client being able to detect this. An attacker can...

GHSA-C35Q-FFPF-5QPM AsyncSSH Rogue Session Attack

Summary An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation. Details The rogue session attack targets any SSH client connecting to an AsyncSSH server, on which the attacker must have a shell...

AsyncSSH Rogue Session Attack

Summary An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation. Details The rogue session attack targets any SSH client connecting to an AsyncSSH server, on which the attacker must have a shell...

pyplanet (0.6.1a1) potentially affected by CVE-2023-46446 via asyncssh (1.13.2)

asyncssh PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet 0.6.1a1 Source cves: CVE-2023-46446 Source advisory: OSV:GHSA-C35Q-FFPF-5QPM...

pyplanet (>=0.4.0, <=0.4.5) potentially affected by CVE-2023-46446 via asyncssh (1.10.1)

asyncssh PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.4.0, =0.4.5 Source cves: CVE-2023-46446 Source advisory: OSV:GHSA-C35Q-FFPF-5QPM...

pyplanet (>=0.0.1, <=0.1.4) potentially affected by CVE-2023-46446 via asyncssh (1.9.0)

asyncssh PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.0.1, =0.1.4 Source cves: CVE-2023-46446 Source advisory: OSV:GHSA-C35Q-FFPF-5QPM...

aioasuswrt (>=1.2.7, <=1.3.3), aiosftp (>=0.0.1, <=0.3.0) +36 more potentially affected by CVE-2023-46446 via asyncssh (>=2.0.1, <=2.14.0)

asyncssh PYPI version =2.0.1, =1.2.7, =0.0.1, =0.6.0, =0.3.0, =1.2.1, =2.9.0, =0.4.0, =0.0.4, =0.35.0, =3.1.1, =0.6.5, =0.8.0a7, =2.8.1, =0.1.0, =0.4.54 and more Source cves: CVE-2023-46446 Source advisory: OSV:GHSA-C35Q-FFPF-5QPM...

pyplanet (>=0.6.0rc1, <=0.6.0) potentially affected by CVE-2023-46446 via asyncssh (1.12.2)

asyncssh PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.6.0rc1, =0.6.0 Source cves: CVE-2023-46446 Source advisory: OSV:GHSA-C35Q-FFPF-5QPM...

pyplanet (>=0.1.5, <=0.3.3) potentially affected by CVE-2023-46446 via asyncssh (1.10.0)

asyncssh PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.1.5, =0.3.3 Source cves: CVE-2023-46446 Source advisory: OSV:GHSA-C35Q-FFPF-5QPM...

aioasuswrt (>=1.1.20, <=1.1.21) potentially affected by CVE-2023-46446 via asyncssh (1.15.0)

asyncssh PYPI version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - aioasuswrt =1.1.20, =1.1.21 Source cves: CVE-2023-46446 Source advisory: OSV:GHSA-C35Q-FFPF-5QPM...

netdev (>=0.9.1, <=0.9.3), pyplanet (>=0.7.0rc1, <=0.11.12) +2 more potentially affected by CVE-2023-46446 via asyncssh (1.18.0)

asyncssh PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - netdev =0.9.1, =0.7.0rc1, =0.0.1, =0.2.1 Source cves: CVE-2023-46446 Source advisory: OSV:GHSA-C35Q-FFPF-5QPM...

pyplanet (>=0.5.3, <=0.5.4) potentially affected by CVE-2023-46446 via asyncssh (1.11.1)

asyncssh PYPI version 1.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.5.3, =0.5.4 Source cves: CVE-2023-46446 Source advisory: OSV:GHSA-C35Q-FFPF-5QPM...

pyplanet (>=0.5.0, <=0.5.2) potentially affected by CVE-2023-46446 via asyncssh (1.11.0)

asyncssh PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.5.0, =0.5.2 Source cves: CVE-2023-46446 Source advisory: OSV:GHSA-C35Q-FFPF-5QPM...

aioasuswrt (>=1.2.7, <=1.3.3), aiosftp (>=0.0.1, <=0.3.0) +36 more potentially affected by CVE-2023-46446 via asyncssh (>=2.0.1, <=2.14.0)

asyncssh PYPI version =2.0.1, =1.2.7, =0.0.1, =0.6.0, =0.3.0, =1.2.1, =2.9.0, =0.4.0, =0.0.4, =0.35.0, =3.1.1, =0.6.5, =0.8.0a7, =2.8.1, =0.1.0, =0.4.54 and more Source cves: CVE-2023-46446 Source advisory: GHSA-C35Q-FFPF-5QPM...

pitcrew (>=0.0.1, <=0.0.3) potentially affected by CVE-2023-46446 via asyncssh (1.16.1)

asyncssh PYPI version 1.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pitcrew =0.0.1, =0.0.3 Source cves: CVE-2023-46446 Source advisory: OSV:GHSA-C35Q-FFPF-5QPM...

pyplanet (>=0.6.0rc1, <=0.6.0) potentially affected by CVE-2023-46445 via asyncssh (1.12.2)

asyncssh PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.6.0rc1, =0.6.0 Source cves: CVE-2023-46445 Source advisory: OSV:GHSA-CFC2-WR2V-GXM5...

pyplanet (>=0.4.0, <=0.4.5) potentially affected by CVE-2023-46445 via asyncssh (1.10.1)

asyncssh PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.4.0, =0.4.5 Source cves: CVE-2023-46445 Source advisory: OSV:GHSA-CFC2-WR2V-GXM5...

pyplanet (>=0.5.0, <=0.5.2) potentially affected by CVE-2023-46445 via asyncssh (1.11.0)

asyncssh PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.5.0, =0.5.2 Source cves: CVE-2023-46445 Source advisory: OSV:GHSA-CFC2-WR2V-GXM5...

aioasuswrt (>=1.1.20, <=1.1.21) potentially affected by CVE-2023-46445 via asyncssh (1.15.0)

asyncssh PYPI version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - aioasuswrt =1.1.20, =1.1.21 Source cves: CVE-2023-46445 Source advisory: OSV:GHSA-CFC2-WR2V-GXM5...