Most recent entries from all

bdu:2024-11318

BREW-dvc-CVE-2023-46445 — AsyncSSH Rogue Extension Negotiation

Affected: Homebrew: dvc

### Summary

An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack.

### Details

The rogue extension negotiation attack targets an AsyncSSH client connecting to any SSH server sending an extension info message. The attack exploits an implementation flaw in the AsyncSSH implementation to inject an extension info message chosen by the attacker and delete the original extension info message, effectively replacing it.

A correct SSH implementation should not process an unauthenticated extension info message. However, the injected message is accepted due to flaws in AsyncSSH. AsyncSSH supports the server-sig-algs and global-requests-ok extensions. Hence, the attacker can downgrade the algorithm used for client authentication by meddling with the value of server-sig-algs (e.g. use of SHA-1 instead of SHA-2).

### PoC

<details> <summary>AsyncSSH Client 2.14.0 (simple_client.py example) connecting to AsyncSSH Server 2.14.0 (simple_server.py example)</summary>

```python #!/usr/bin/python3 import socket from threading import Thread from binascii import unhexlify ##################################################################################### ## Proof of Concept for the rogue extension negotiation attack (ChaCha20-Poly1305) ## ## ## ## Client(s) tested: AsyncSSH 2.14.0 (sim…

EUVD-2026-270669

fkie_cve-2023-46445

An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."

GHSA-cfc2-wr2v-gxm5 — AsyncSSH Rogue Extension Negotiation

Affected: PyPI: asyncssh

### Summary

An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack.

### Details

### PoC

<details> <summary>AsyncSSH Client 2.14.0 (simple_client.py example) connecting to AsyncSSH Server 2.14.0 (simple_server.py example)</summary>

gsd-2023-46445

openSUSE-SU-2024:13417-1 — python310-asyncssh-2.14.1-1.1 on GA media

python310-asyncssh-2.14.1-1.1 on GA media

PYSEC-2023-237

Affected: PyPI: asyncssh

An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack.

UBUNTU-CVE-2023-46445

Affected: Ubuntu:16.04:LTS: python-asyncssh, Ubuntu:Pro:18.04:LTS: python-asyncssh, Ubuntu:20.04:LTS: python-asyncssh, Ubuntu:22.04:LTS: python-asyncssh, Ubuntu:Pro:24.04:LTS: python-asyncssh

An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."