DEBIAN-CVE-2026-77473: Medium severity debian/python-asyncssh vulnerability
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, recursive remote-to-local SFTP copies in SFTPClient.copy() in asyncssh/sftp.py, reached through get(), mget(), and copy(), trust filenames returned by a remote server's directory enumeration. A malicious or compromised SFTP server can return an absolute filename or a filename containing path separators and parent-directory traversal, causing destination path construction to escape the requested local directory and write attacker-selected content to locations writable by the client process. This issue is fixed in version 2.24.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
asyncsshto a version that resolves this vulnerability.Fixed in 2.24.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Clients using AsyncSSH versions before 2.24.1 are exposed when they perform recursive remote-to-local SFTP copies using get(), mget(), or copy() against a malicious or compromised SFTP server.
What does an attacker need to exploit it?
The attacker must control, or have compromised, an SFTP server contacted by the client and be able to return crafted filenames during directory enumeration. No client credentials are required, but the client must initiate a recursive copy and interact with the malicious server.
What is the impact on the local system?
Crafted absolute paths, path separators, or parent-directory traversal sequences can cause copied content to be written outside the local directory requested by the client. Writes are limited to locations writable by the client process.
How can this be remediated?
Upgrade AsyncSSH to version 2.24.1, which fixes the filename handling issue. If upgrading is not immediately possible, avoid recursive remote-to-local SFTP copies from untrusted or potentially compromised servers.