USN-7051-1: AsyncSSH vulnerability
Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If a remote attacker was able to intercept SSH communications, extension negotiation messages could be truncated, possibly leading to certain algorithms and features being downgraded. This issue is known as the Terrapin attack. This update adds protocol extensions to mitigate this issue.
Affected Software
Frequently Asked Questions
What is the severity of USN-7051-1?
The severity of USN-7051-1 is categorized as high due to the potential for remote code execution through an SSH protocol vulnerability.
How do I fix USN-7051-1?
To fix USN-7051-1, you should update your python3-asyncssh package to the recommended versions provided by the Ubuntu security advisory.
What versions are affected by USN-7051-1?
USN-7051-1 affects specific versions of the python3-asyncssh package on Ubuntu 20.04, 22.04, and 24.04.
Who discovered the vulnerability detailed in USN-7051-1?
The vulnerability in USN-7051-1 was discovered by Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk.
What types of attacks can be executed due to USN-7051-1?
USN-7051-1 is susceptible to prefix truncation attacks, which could lead to misconfigured SSH communication and algorithm negotiation failures.