UBUNTU-CVE-2026-77473: Medium severity ubuntu/python-asyncssh vulnerability
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, recursive remote-to-local SFTP copies in SFTPClient.copy() in asyncssh/sftp.py, reached through get(), mget(), and copy(), trust filenames returned by a remote server's directory enumeration. A malicious or compromised SFTP server can return an absolute filename or a filename containing path separators and parent-directory traversal, causing destination path construction to escape the requested local directory and write attacker-selected content to locations writable by the client process. This issue is fixed in version 2.24.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AsyncSSHto a version that resolves this vulnerability.Fixed in 2.24.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Clients using AsyncSSH to perform recursive remote-to-local SFTP transfers are exposed when they connect to a malicious or compromised SFTP server. The affected paths are SFTPClient.get(), mget(), and copy() when they reach recursive copying.
What does an attacker need to exploit it?
An attacker needs control of, or the ability to manipulate responses from, the SFTP server used by the client. They can return crafted directory-entry filenames containing absolute paths, path separators, or parent-directory traversal.
What is the practical impact on the client?
Crafted filenames can cause downloaded content to be written outside the local destination directory requested by the client. Writes are limited to locations writable by the client process.
What should be done if upgrading cannot happen immediately?
Avoid recursive remote-to-local SFTP copies from untrusted or potentially compromised servers. Run affected transfers with a client account that has minimal filesystem write permissions.
How can I determine whether a deployment is affected?
Check whether the installed AsyncSSH version is earlier than 2.24.1 and whether the application performs recursive SFTP downloads using get(), mget(), or copy(). Version 2.24.1 contains the fix.