PyPI/asyncssh CVE-2018-7749: unknown, EPSS 1.75%

The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authen

Action: Upgrade asyncssh to 1.12.1 or later.

pip install asyncssh==1.12.1

Affected

Fixed versions

Sources

• osv: PYSEC-2018-108
• https://github.com/ronf/asyncssh/commit/c161e26cdc0d41b745b63d9f17b437f073bf7ba4
• https://groups.google.com/forum/#!msg/asyncssh-announce/57_5O7kiHSA/8BXZ_hxHAQAJ
• https://github.com/advisories/GHSA-97cv-6pjf-5f9q

CVE-2018-7749 · published 2018-03-12T19:29:00Z · modified 2026-06-10T17:00:10.905276221Z · JSON