Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. asyncssh
  4. ›
  5. CVE-2023-46445

CVE-2023-46445: AsyncSSH Rogue Extension Negotiation

November 9, 2023 (updated November 4, 2025)

An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack.

References

  • github.com/advisories/GHSA-cfc2-wr2v-gxm5
  • github.com/pypa/advisory-database/tree/main/vulns/asyncssh/PYSEC-2023-237.yaml
  • github.com/ronf/asyncssh
  • github.com/ronf/asyncssh/blob/develop/docs/changes.rst
  • github.com/ronf/asyncssh/commit/83e43f5ea3470a8617fc388c72b062c7136efd7e
  • github.com/ronf/asyncssh/security/advisories/GHSA-cfc2-wr2v-gxm5
  • lists.debian.org/debian-lts-announce/2024/09/msg00042.html
  • lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ME34ROZWMDK5KLMZKTSA422XVJZ7IMTE
  • nvd.nist.gov/vuln/detail/CVE-2023-46445
  • security.netapp.com/advisory/ntap-20231222-0001
  • www.terrapin-attack.com/

Code Behaviors & Features

Detect and mitigate CVE-2023-46445 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 2.14.1

Fixed versions

  • 2.14.1

Solution

Upgrade to version 2.14.1 or above.

Impact 5.9 MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Learn more about CVSS

Weakness

  • CWE-345: Insufficient Verification of Data Authenticity
  • CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data
  • CWE-354: Improper Validation of Integrity Check Value

Source file

pypi/asyncssh/CVE-2023-46445.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 05 Nov 2025 00:18:43 +0000.