USN-7108-1

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-7108-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-7108-1.json
JSON Data
https://api.osv.dev/v1/vulns/USN-7108-1
Related
Published
2024-11-18T05:27:15.572259Z
Modified
2024-11-18T05:27:15.572259Z
Summary
python-asyncssh vulnerabilities
Details

Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that AsyncSSH did not properly handle the extension info message. An attacker able to intercept communications could possibly use this issue to downgrade the algorithm used for client authentication. (CVE-2023-46445)

Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that AsyncSSH did not properly handle the user authentication request message. An attacker could possibly use this issue to control the remote end of an SSH client session via packet injection/removal and shell emulation. (CVE-2023-46446)

References

Affected packages

Ubuntu:20.04:LTS / python-asyncssh

Package

Name
python-asyncssh
Purl
pkg:deb/ubuntu/python-asyncssh?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.12.2-1ubuntu0.2

Affected versions

1.*

1.12.2-1
1.12.2-1ubuntu0.1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "1.12.2-1ubuntu0.2",
            "binary_name": "python-asyncssh-doc"
        },
        {
            "binary_version": "1.12.2-1ubuntu0.2",
            "binary_name": "python3-asyncssh"
        }
    ]
}

Ubuntu:22.04:LTS / python-asyncssh

Package

Name
python-asyncssh
Purl
pkg:deb/ubuntu/python-asyncssh?arch=src?distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.5.0-1ubuntu0.1

Affected versions

2.*

2.5.0-1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "2.5.0-1ubuntu0.1",
            "binary_name": "python-asyncssh-doc"
        },
        {
            "binary_version": "2.5.0-1ubuntu0.1",
            "binary_name": "python3-asyncssh"
        }
    ]
}

Ubuntu:Pro:24.04:LTS / python-asyncssh

Package

Name
python-asyncssh
Purl
pkg:deb/ubuntu/python-asyncssh?arch=src?distro=esm-apps/noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.10.1-2ubuntu0.1+esm1

Affected versions

2.*

2.10.1-2
2.10.1-2ubuntu0.1

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "2.10.1-2ubuntu0.1+esm1",
            "binary_name": "python-asyncssh-doc"
        },
        {
            "binary_version": "2.10.1-2ubuntu0.1+esm1",
            "binary_name": "python3-asyncssh"
        }
    ]
}