USN-7108-1: AsyncSSH vulnerabilities
Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that AsyncSSH did not properly handle the extension info message. An attacker able to intercept communications could possibly use this issue to downgrade the algorithm used for client authentication. (CVE-2023-46445) Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that AsyncSSH did not properly handle the user authentication request message. An attacker could possibly use this issue to control the remote end of an SSH client session via packet injection/removal and shell emulation. (CVE-2023-46446)
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-7108-1?
The severity of USN-7108-1 is considered to be critical due to the potential for algorithm downgrade in client authentication.
How do I fix USN-7108-1?
To fix USN-7108-1, upgrade the python3-asyncssh package to the recommended version for your Ubuntu release.
Who discovered the vulnerability identified as USN-7108-1?
The vulnerability USN-7108-1 was discovered by researchers Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk.
What does the USN-7108-1 vulnerability affect?
The USN-7108-1 vulnerability affects the AsyncSSH library used in various Ubuntu releases.
Can the USN-7108-1 vulnerability be exploited remotely?
Yes, the USN-7108-1 vulnerability can potentially be exploited remotely by an attacker who can intercept communications.