PyPI/asyncssh: medium 5.9

AsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC

Action: Upgrade asyncssh to 2.14.2 or later.

pip install asyncssh==2.14.2

Affected

Fixed versions

Sources

• osv: GHSA-hfmc-7525-mj55
• https://github.com/ronf/asyncssh/security/advisories/GHSA-hfmc-7525-mj55
• https://github.com/ronf/asyncssh/commit/0bc73254f41acb140187e0c89606311f88de5b7b
• https://github.com/ronf/asyncssh/commit/69f5a41b458b29367a65fe469c2b0255b5db210a
• https://github.com/ronf/asyncssh

published 2023-12-18T19:21:45Z · modified 2024-12-07T05:40:31.605685Z · JSON