Rogue Extension Negotiation Vulnerability in AsyncSSH Package
Summary
CVE-2023-46445: An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Extension Negotiation.". Affects python-asyncssh across 2 version ranges.
< 0d6de9aec1a81a4f6ff7400c24b699eb6137fba3
< 2.5.0-0.1+deb11u1
Fixed in 2.5.0-0.1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AsyncSSH is a Python library that provides an asynchronous SSH and SFTP client and server implementation. It is designed to be used with Python's asyncio framework, allowing developers to build applications that require secure shell access and file transfer capabilities. The library is widely used for its efficiency and ease of integration into asynchronous applications. However, a recent vulnerability has been identified that could allow attackers to manipulate extension negotiation messages, potentially compromising the integrity of the communication.
Vulnerability Detail
An issue in AsyncSSH before version 2.14.1 allows attackers to control the extension info message (RFC 8308) through a man-in-the-middle attack, known as 'Rogue Extension Negotiation.' This vulnerability can lead to unauthorized access and manipulation of SSH sessions, posing a significant risk to the confidentiality and integrity of data transmitted over affected connections. The vulnerability arises from improper handling of extension negotiation, making it exploitable in scenarios where an attacker can intercept and modify the communication between the client and server.
How To Fix
Minimum fixed version
2.5.0-0.1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-asyncsshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing network security measures such as using VPNs or SSH tunneling to mitigate the risk of man-in-the-middle attacks. Additionally, ensure that all communications are encrypted and monitor network traffic for any suspicious activity.
Conclusion
The Rogue Extension Negotiation vulnerability in AsyncSSH poses a significant risk to secure communications. Users are strongly advised to upgrade to the latest version to protect against potential exploitation. Implementing additional security measures can also help mitigate risks while awaiting updates.
See every vulnerability recorded for python-asyncssh →
FAQ
The CVSS score for this vulnerability is 5.9, indicating a moderate level of severity.
AsyncSSH versions prior to 2.14.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access and manipulation of SSH sessions, compromising the confidentiality and integrity of data.
Yes, implementing network security measures such as VPNs or SSH tunneling can help mitigate the risk of man-in-the-middle attacks.
Related vulnerabilities
Recent vulnerabilities recorded for python-asyncssh.
