← Vulnerability feed

Vulnerability record · CVE-2023-46445 · published 14 November 2023

CVE-2023-46445: Asyncssh project asyncssh insufficient verification of data authenticity vulnerability

Asyncssh Project · Asyncssh

An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."

5.9 CVSS 3.1 Medium EPSS 0.59% · top 54.1% CWE-345 · Insufficient verification of data authenticity
5.9CVSS 3.1 base score
0.59%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
15References
17 Jun 2026Last modified by NVD

Description

An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html
https://github.com/advisories/GHSA-cfc2-wr2v-gxm5
https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst
https://github.com/ronf/asyncssh/security/advisories/GHSA-cfc2-wr2v-gxm5 Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ME34ROZWMDK5KLMZKTSA422
https://security.netapp.com/advisory/ntap-20231222-0001/
https://www.terrapin-attack.com
http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html
https://github.com/advisories/GHSA-cfc2-wr2v-gxm5
https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst
https://github.com/ronf/asyncssh/security/advisories/GHSA-cfc2-wr2v-gxm5 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/09/msg00042.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ME34ROZWMDK5KLMZKTSA422
https://security.netapp.com/advisory/ntap-20231222-0001/
https://www.terrapin-attack.com

Track CVE-2023-46445 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-7749Asyncssh project asyncssh improper authentication vulnerabilityThe SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests.…EPSS 1.7%8.2CVE-2026-45309Asyncssh project asyncssh path traversal vulnerabilityAsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio frame…EPSS 0.59%6.8CVE-2023-46446Asyncssh project asyncssh insecure direct object reference vulnerabilityAn issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulati…EPSS 0.87%5.9CVE-2023-48795SSH Terrapin attack downgrades channel integrity in OpenSSH and many SSH implementationsThe SSH transport protocol with certain OpenSSH extensions mishandles the handshake and sequence numbers, letting a remote attacker omit packets from…EPSS 93%analysed7.8CVE-2023-38831WinRAR ZIP archive spoofing leads to arbitrary code executionWinRAR before 6.23 mishandles ZIP archives that contain a benign file and a folder with the same name, causing the folder's contents to be processed …KEVEPSS 100%analysed9.8CVE-2022-26871Trend Micro Apex Central unauthenticated arbitrary file uploadTrend Micro Apex Central (and Apex One) contains an arbitrary file upload flaw caused by insufficient verification of data authenticity (CWE-345). An…KEVEPSS 19%analysed

Source: NIST National Vulnerability Database (record CVE-2023-46445), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.