p PatchFirst

CVE-2023-46445

CVE-2023-46445

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."

CVSS 5.9 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • python-asyncssh Debian:12

    Versions
    • 2.10.1-2
    • 2.10.1-2+deb12u1
    Affected ranges
    • ECOSYSTEM: < 2.10.1-2+deb12u2

    Update to 2.10.1-2+deb12u2

  • python-asyncssh Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.15.0-1

    Update to 2.15.0-1

  • python-asyncssh Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.15.0-1

    Update to 2.15.0-1

  • asyncssh PyPI

    Versions
    • 0.8.1
    • 0.8.2
    • 0.8.3
    • 0.8.4
    • 0.9.0
    • 0.9.1
    • 0.9.2
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.1.1
    • 1.10.0
    • 1.10.1
    • 1.11.0
    • 1.11.1
    • 1.12.0
    • 1.12.1
    • 1.12.2
    • 1.13.0
    • 1.13.1
    • 1.13.2
    • 1.13.3
    • 1.14.0
    • 1.15.0
    • 1.15.1
    • 1.16.0
    • 1.16.1
    • 1.17.0
    • 1.17.1
    • 1.18.0
    • 1.2.0
    • 1.2.1
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.4.1
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 1.5.4
    • 1.5.5
    • 1.5.6
    • 1.6.0
    • 1.6.1
    • 1.6.2
    • 1.7.1
    • 1.7.2
    • 1.7.3
    • 1.8.0
    • 1.8.1
    • 1.9.0
    • 2.0.0
    • 2.0.1
    • 2.1.0
    • 2.10.0
    • 2.10.1
    • 2.11.0
    • 2.12.0
    • 2.13.0
    • 2.13.1
    • 2.13.2
    • 2.14.0
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.4.0
    • 2.4.1
    • 2.4.2
    • 2.5.0
    • 2.6.0
    • 2.7.0
    • 2.7.1
    • 2.7.2
    • 2.8.0
    • 2.8.1
    • 2.9.0
    Affected ranges
    • ECOSYSTEM: < 2.14.1

    Update to 2.14.1

  • python-asyncssh Ubuntu:16.04:LTS

    Versions
    • 1.2.0-1
    • 1.2.1-1
    • 1.3.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-asyncssh Ubuntu:Pro:18.04:LTS

    Versions
    • 1.8.1-2
    • 1.11.0-2
    • 1.11.1-1
    • 1.11.1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1.11.1-1ubuntu0.1~esm2

    Update to 1.11.1-1ubuntu0.1~esm2

  • python-asyncssh Ubuntu:20.04:LTS

    Versions
    • 1.12.2-1
    • 1.12.2-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 1.12.2-1ubuntu0.2

    Update to 1.12.2-1ubuntu0.2

  • python-asyncssh Ubuntu:22.04:LTS

    Versions
    • 2.5.0-1
    Affected ranges
    • ECOSYSTEM: < 2.5.0-1ubuntu0.1

    Update to 2.5.0-1ubuntu0.1

  • python-asyncssh Ubuntu:Pro:24.04:LTS

    Versions
    • 2.10.1-2
    • 2.10.1-2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 2.10.1-2ubuntu0.1+esm1

    Update to 2.10.1-2ubuntu0.1+esm1

Original sources

Check your server →