PT-2023-9800 · Asyncssh+4 · Asyncssh+4

Lambdafu + 1 · Published 2023-11-09 · Updated 2025-03-10 · CVE-2023-46445

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions AsyncSSH versions prior to 2.14.1

Description The issue in AsyncSSH allows attackers to control the extension info message via a man-in-the-middle attack, enabling them to conduct algorithm downgrade attacks during user authentication. This can be achieved by exploiting the implementation flaw in AsyncSSH to inject an extension info message chosen by the attacker and delete the original extension info message. The attacker can meddle with the value of server-sig-algs to use a weaker algorithm, such as SHA-1 instead of SHA-2.

Recommendations For versions prior to 2.14.1, update to version 2.14.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable server-sig-algs extension until a patch is available. Avoid using the server-sig-algs extension in the affected API endpoint until the issue is resolved.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-349

CWE-345

CWE-354

Related Identifiers

ALT-PU-2025-2804

BDU:2024-11318

CVE-2023-46445

DLA-3899-1

GHSA-CFC2-WR2V-GXM5

OPENSUSE-SU-2024:13417-1

PYSEC-2023-237

USN-7108-1

USN-7108-2

Affected Products

Alt Linux

Asyncssh

Linuxmint

Red Os

Ubuntu

References · 44

• https://security-tracker.debian.org/tracker/CVE-2023-46445 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ME34ROZWMDK5KLMZKTSA422XVJZ7IMTE · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-237 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3899-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7108-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-46445 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46445 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-46445 · Security Note
• https://ubuntu.com/security/notices/USN-7108-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46446 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-46445 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7108-2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7108-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-46445 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46445 · Vendor Advisory