An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7108-1 advisory.

    Fabian Bumer, Marcus Brinkmann, and Jrg Schwenk discovered that AsyncSSH did not properly handle the     extension info message. An attacker able to intercept communications could possibly use this issue to     downgrade the algorithm used for client authentication. (CVE-2023-46445)

    Fabian Bumer, Marcus Brinkmann, and Jrg Schwenk discovered that AsyncSSH did not properly handle the     user authentication request message. An attacker could possibly use this issue to control the remote end     of an SSH client session via packet injection/removal and shell emulation. (CVE-2023-46446)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3899 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3899-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     September 27, 2024                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-asyncssh     Version        : 2.5.0-0.1+deb11u1     CVE ID         : CVE-2023-46445 CVE-2023-46446 CVE-2023-48795     Debian Bug     : 1055999 1056000 1059007

    AsyncSSH is a Python package which provides an asynchronous client     and server implementation of the SSHv2 protocol on top of the Python     3.4+ asyncio framework. It has been discovered that it is vulnerable to

    CVE-2023-46445

        A vulnerability has been discovered that allows attackers to control         the extension info message (RFC 8308) via a man-in-the-middle attack         (aka Rogue Extension Negotiation).

    CVE-2023-46446

        A vulnerability has been discovered that allows attackers to control         the remote end of an SSH client session via packet injection/removal         and shell emulation (aka Rogue Session attack).

    CVE-2023-48795

        A vulnerability has been discovered allows remote attackers to bypass         integrity checks, and a client and server may consequently end up with         a connection for which some security features have been downgraded or         disabled (aka Terrapin attack).

    For Debian 11 bullseye, these problems have been fixed in version     2.5.0-0.1+deb11u1.

    We recommend that you upgrade your python-asyncssh packages.

    For the detailed security status of python-asyncssh please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-asyncssh

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

    Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-d2956318e4 advisory.

    Security fix for CVE-2023-46446 and CVE-2023-46445

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210948	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : AsyncSSH vulnerabilities (USN-7108-1)	Nessus	Ubuntu Local Security Checks	medium
207872	Debian dla-3899 : python-asyncssh-doc - security update	Nessus	Debian Local Security Checks	critical
186277	Fedora 39 : python-asyncssh (2023-d2956318e4)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2023-46445

medium

Tenable Plugins

medium

critical

medium