PyPI/asyncssh CVE-2023-46445: medium 5.9, EPSS 0.59%

An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack.

Action: Upgrade asyncssh to 2.14.1 or later.

pip install asyncssh==2.14.1

Affected

Fixed versions

Sources

• osv: PYSEC-2023-237
• https://github.com/ronf/asyncssh/security/advisories/GHSA-cfc2-wr2v-gxm5

CVE-2023-46445 · published 2023-11-14T03:15:00Z · modified 2023-11-17T17:41:55.151148Z · JSON