The remote Debian 11 / 12 host has a package installed that is affected by a vulnerability as referenced in the dsa-5600 advisory.

    -----BEGIN PGP SIGNED MESSAGE-----     Hash: SHA512

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5600-1                   security@debian.org     https://www.debian.org/security/                       Sebastien Delafond     January 12, 2024                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : php-phpseclib     CVE ID         : CVE-2023-48795

    Fabian Baeumer, Marcus Brinkmann and Joerg Schwenk discovered that the     SSH protocol is prone to a prefix truncation attack, known as the     Terrapin attack. This attack allows a MITM attacker to effect a     limited break of the integrity of the early encrypted SSH transport     protocol by sending extra messages prior to the commencement of     encryption, and deleting an equal number of consecutive messages     immediately after encryption starts.

    Details can be found at https://terrapin-attack.com/

    For the oldstable distribution (bullseye), this problem has been fixed     in version 2.0.30-2+deb11u1.

    For the stable distribution (bookworm), this problem has been fixed in     version 2.0.42-1+deb12u1.

    We recommend that you upgrade your php-phpseclib packages.

    For the detailed security status of php-phpseclib please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/php-phpseclib

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org
    -----BEGIN PGP SIGNATURE-----

    iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmWg5P4ACgkQEL6Jg/PV     nWTO8Qf+MjlqXFJ0p865PgV30sQmWeJmc8UiX/lOO9ayLUZ13Dj4z74H40XxAz0M     rHDnpfs3hvtgTkdRkE+k2FvrMgau+EpN1eGwgrHURHN/Kdz9Z6YLQX/T8LZq97SZ     VVu/X/+xkiZng0J+UXZx5BWQFf/vGz5vLiPA3JUSgS3KjwOYiZKIaSf+/7SF48he     QTucpa7nC/7ew4dgLLNTa9PQWK8C616cJ6iZZaowi8k3QmUQGkyhuXS0EUHHRkxq     EEf7HccwpwYbPAAkh5cIckEoXEC2gUkl2UmpzCFNdJl/xqz02xOfcgoDxM/1bYy2     Bn3cNLe681fmEd7ShPdNTYtqz6YvwQ==     =ZVcV
    -----END PGP SIGNATURE-----



Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dsa-5600 : php-phpseclib - security update

critical Nessus Plugin ID 189091

Version 1.1

Version 1.0

Version 1.1 Jan 24, 2025, 9:25 PM CVSS metrics ("Cvssv4 score" set to 9.3) CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:P") CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N") Plugin metadata Plugin Feed: 202501242125
Version 1.0 Jan 17, 2024, 12:13 AM New Plugin Feed: 202401170013