https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 21:29:48 +0000 https://vulnerability.circl.lu/vuln/cve-2023-46445 <p>An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a &#34;Rogue Extension Negotiation.&#34;</p> <p>An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a &#34;Rogue Extension Negotiation.&#34;</p> https://vulnerability.circl.lu/vuln/cve-2023-46445 https://vulnerability.circl.lu/vuln/usn-7108-1 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: python-asyncssh, Ubuntu:22.04:LTS: python-asyncssh, Ubuntu:Pro:24.04:LTS: python-asyncssh</p> <p>Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that AsyncSSH did not properly handle the extension info message. An attacker able to intercept communications could possibly use this issue to downgrade the algorithm used for client authentication. (CVE-2023-46445)</p> <p>Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that AsyncSSH did not properly handle the user authentication request message. An attacker could possibly use this issue to control the remote end of an SSH client session via packet injection/removal and shell emulation. (CVE-2023-46446)</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: python-asyncssh, Ubuntu:22.04:LTS: python-asyncssh, Ubuntu:Pro:24.04:LTS: python-asyncssh</p> <p>Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that AsyncSSH did not properly handle the extension info message. An attacker able to intercept communications could possibly use this issue to downgrade the algorithm used for client authentication. (CVE-2023-46445)</p> <p>Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that AsyncSSH did not properly handle the user authentication request message. An attacker could possibly use this issue to control the remote end of an SSH client session via packet injection/removal and shell emulation. (CVE-2023-46446)</p> https://vulnerability.circl.lu/vuln/usn-7108-1