pyplanet (0.6.1a1) potentially affected by CVE-2023-46445 via asyncssh (1.13.2)

asyncssh PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet 0.6.1a1 Source cves: CVE-2023-46445 Source advisory: OSV:GHSA-CFC2-WR2V-GXM5...

pyplanet (>=0.0.1, <=0.1.4) potentially affected by CVE-2023-46445 via asyncssh (1.9.0)

asyncssh PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.0.1, =0.1.4 Source cves: CVE-2023-46445 Source advisory: OSV:GHSA-CFC2-WR2V-GXM5...

pyplanet (>=0.5.3, <=0.5.4) potentially affected by CVE-2023-46445 via asyncssh (1.11.1)

asyncssh PYPI version 1.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.5.3, =0.5.4 Source cves: CVE-2023-46445 Source advisory: OSV:GHSA-CFC2-WR2V-GXM5...

aioasuswrt (>=1.2.7, <=1.3.3), aiosftp (>=0.0.1, <=0.3.0) +36 more potentially affected by CVE-2023-46445 via asyncssh (>=2.0.1, <=2.14.0)

asyncssh PYPI version =2.0.1, =1.2.7, =0.0.1, =0.6.0, =0.3.0, =1.2.1, =2.9.0, =0.4.0, =0.0.4, =0.35.0, =3.1.1, =0.6.5, =0.8.0a7, =2.8.1, =0.1.0, =0.4.54 and more Source cves: CVE-2023-46445 Source advisory: GHSA-CFC2-WR2V-GXM5...

GHSA-CFC2-WR2V-GXM5 AsyncSSH Rogue Extension Negotiation

Summary An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack. Details The rogue extension negotiation attack targets an AsyncSSH client connecting to any SSH server sending an extension info message. The attack...

aioasuswrt (>=1.2.7, <=1.3.3), aiosftp (>=0.0.1, <=0.3.0) +36 more potentially affected by CVE-2023-46445 via asyncssh (>=2.0.1, <=2.14.0)

asyncssh PYPI version =2.0.1, =1.2.7, =0.0.1, =0.6.0, =0.3.0, =1.2.1, =2.9.0, =0.4.0, =0.0.4, =0.35.0, =3.1.1, =0.6.5, =0.8.0a7, =2.8.1, =0.1.0, =0.4.54 and more Source cves: CVE-2023-46445 Source advisory: OSV:GHSA-CFC2-WR2V-GXM5...

netdev (>=0.9.1, <=0.9.3), pyplanet (>=0.7.0rc1, <=0.11.12) +2 more potentially affected by CVE-2023-46445 via asyncssh (1.18.0)

asyncssh PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - netdev =0.9.1, =0.7.0rc1, =0.0.1, =0.2.1 Source cves: CVE-2023-46445 Source advisory: OSV:GHSA-CFC2-WR2V-GXM5...

pitcrew (>=0.0.1, <=0.0.3) potentially affected by CVE-2023-46445 via asyncssh (1.16.1)

asyncssh PYPI version 1.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pitcrew =0.0.1, =0.0.3 Source cves: CVE-2023-46445 Source advisory: OSV:GHSA-CFC2-WR2V-GXM5...

AsyncSSH Rogue Extension Negotiation

Summary An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack. Details The rogue extension negotiation attack targets an AsyncSSH client connecting to any SSH server sending an extension info message. The attack...

pyplanet (>=0.1.5, <=0.3.3) potentially affected by CVE-2023-46445 via asyncssh (1.10.0)

asyncssh PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.1.5, =0.3.3 Source cves: CVE-2023-46445 Source advisory: OSV:GHSA-CFC2-WR2V-GXM5...

PT-2023-9800

Name of the Vulnerable Software and Affected Versions AsyncSSH versions prior to 2.14.1 Description The issue in AsyncSSH allows attackers to control the extension info message via a man-in-the-middle attack, enabling them to conduct algorithm downgrade attacks during user authentication. This ca...

PT-2023-9801

Name of the Vulnerable Software and Affected Versions AsyncSSH versions 2.14.0 and earlier Description The issue in AsyncSSH allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, also known as a "Rogue Session Attack." This can lead ...

Ubuntu 18.04 ESM : AsyncSSH vulnerability (USN-4854-1)

The remote Ubuntu 18.04 ESM host has a package installed that is affected by a vulnerability as referenced in the USN-4854-1 advisory. Matthijs Kooijman discovered that AsyncSSH server did not properly handle authentication under certain conditions. An attacker with a specially crafted client cou...

Ubuntu: Security Advisory (USN-4854-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

pyplanet (>=0.0.1, <=0.5.4) potentially affected by CVE-2018-7749 via asyncssh (>=1.9.0, <=1.11.1)

asyncssh PYPI version =1.9.0, =0.0.1, =0.5.4 Source cves: CVE-2018-7749 Source advisory: OSV:GHSA-97CV-6PJF-5F9Q...

AsyncSSH SSH Server Authentication Bypass

The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step...

pyplanet (>=0.0.1, <=0.5.4) potentially affected by CVE-2018-7749 via asyncssh (>=1.9.0, <=1.11.1)

asyncssh PYPI version =1.9.0, =0.0.1, =0.5.4 Source cves: CVE-2018-7749 Source advisory: GHSA-97CV-6PJF-5F9Q...

GHSA-97CV-6PJF-5F9Q AsyncSSH SSH Server Authentication Bypass

The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step...

USN-4854-1: AsyncSSH vulnerability

Matthijs Kooijman discovered that AsyncSSH server did not properly handle authentication under certain conditions. An attacker with a specially crafted client could use this vulnerability to skip authentication of SSH sessions...

USN-4854-1 python-asyncssh vulnerability

Matthijs Kooijman discovered that AsyncSSH server did not properly handle authentication under certain conditions. An attacker with a specially crafted client could use this vulnerability to skip authentication of SSH sessions...