Alerts This Week
Warning Icon 1 640
Alerts This Week
Warning Icon 1 640

Ubuntu 24.04 LTS Security Notice USN-7051-1: Medium Risk AsyncSSH Issue

ubuntu
Calendar Grey October 2, 2024
Dist Ubuntu Esm H88
An issue related to a protocol vulnerability in python-asyncssh has been rectified in Ubuntu versions 24.04, 22.04, and 20.04 LTS. Discover details regarding the recent security modification.
A protocol flaw was fixed in AsyncSSH.

Summary

A protocol flaw was fixed in AsyncSSH.

Software Description:

- python-asyncssh: asyncio-based client and server implementation of SSHv2

protocol

Details:

Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH

protocol was vulnerable to a prefix truncation attack. If a remote attacker

was able to intercept SSH communications, extension negotiation messages

could be truncated, possibly leading to certain algorithms and features

being downgraded. This issue is known as the Terrapin attack. This update

adds protocol extensions to mitigate this issue.

Topics%20covered

Topics Covered

security advisory remote access ubuntu python downgrade attack protocol flaw asyncssh

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
   python3-asyncssh                2.10.1-2ubuntu0.1

Ubuntu 22.04 LTS
   python3-asyncssh                2.5.0-1ubuntu0.1~esm1
                                   Available with Ubuntu Pro

Ubuntu 20.04 LTS
   python3-asyncssh                1.12.2-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-7051-1

  CVE-2023-48795

Severity
medium
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-7051-1

Topics%20covered

Topics Covered

security advisory remote access ubuntu python downgrade attack protocol flaw asyncssh

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here