CVE-2023-46445: AsyncSSH Extension Info Message Control
Summary
CVE-2023-46445: An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack. Affects asyncssh versions < 2.14.1. Fixed in 2.14.1. How to fix ↓
Also tracked for
- python-asyncssh · Debian:11
The same CVE-2023-46445 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AsyncSSH is a Python library that provides an asynchronous client and server implementation of the SSHv2 protocol. It allows secure remote command execution, file transfer, and tunneling capabilities. The library is widely used in various Python applications for secure communication over SSH. However, versions up to 2.14.0 are vulnerable to a man-in-the-middle attack that enables attackers to control the extension info message (RFC 8308).
Vulnerability Detail
The vulnerability in AsyncSSH allows an attacker to manipulate the extension info message during an SSH session. By intercepting the communication between the client and server, an attacker can modify the extension info message, potentially leading to unauthorized access, data manipulation, or other malicious activities. This vulnerability poses a significant risk to the confidentiality and integrity of SSH connections.
How To Fix
Latest published version: 2.24.1 as of 23 Oct 2026
pip install --upgrade "asyncssh==2.24.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.14.1
This is the first release that contains the fix.
pip install --upgrade "asyncssh==2.14.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to AsyncSSH version 2.14.1 or later.
Conclusion
The vulnerability in AsyncSSH versions up to 2.14.0 allows attackers to control the extension info message during an SSH session. To mitigate this risk, it is crucial to upgrade to AsyncSSH version 2.14.1 or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for asyncssh →
FAQ
AsyncSSH is a Python library that provides an asynchronous client and server implementation of the SSHv2 protocol. It enables secure remote command execution, file transfer, and tunneling capabilities.
This vulnerability allows attackers to control the extension info message during an SSH session, potentially leading to unauthorized access, data manipulation, or other malicious activities.
To fix this vulnerability, upgrade to AsyncSSH version 2.14.1 or later.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the latest version of AsyncSSH.
For more information about this vulnerability, refer to the official advisory at https://github.com/pypa/advisory-database/blob/main/vulns/asyncssh/PYSEC-2023-237.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for asyncssh.
