An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via     packet injection/removal and shell emulation, aka a Rogue Session Attack. (CVE-2023-46446)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1054 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-46445:
    An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a     man-in-the-middle attack, aka a Rogue Extension Negotiation.

    CVE-2023-46446:
    An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via     packet injection/removal and shell emulation, aka a Rogue Session Attack.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:4664 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    These new packages include numerous enhancements, bug fixes, and known issues. Space precludes documenting     all of these changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for     information on the most significant of these changes:

    https://docs.redhat.com/en/documentation/red_hat_ceph_storage/7/html/7.1_release_notes

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via
    packet injection/removal and shell emulation, aka a "Rogue Session Attack." (CVE-2023-46446)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7108-2 advisory.

    USN-7108-1 fixed vulnerabilities in AysncSSH. This update provides the corresponding update for Ubuntu     18.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7108-1 advisory.

    Fabian Bumer, Marcus Brinkmann, and Jrg Schwenk discovered that AsyncSSH did not properly handle the     extension info message. An attacker able to intercept communications could possibly use this issue to     downgrade the algorithm used for client authentication. (CVE-2023-46445)

    Fabian Bumer, Marcus Brinkmann, and Jrg Schwenk discovered that AsyncSSH did not properly handle the     user authentication request message. An attacker could possibly use this issue to control the remote end     of an SSH client session via packet injection/removal and shell emulation. (CVE-2023-46446)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3899 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3899-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     September 27, 2024                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-asyncssh     Version        : 2.5.0-0.1+deb11u1     CVE ID         : CVE-2023-46445 CVE-2023-46446 CVE-2023-48795     Debian Bug     : 1055999 1056000 1059007

    AsyncSSH is a Python package which provides an asynchronous client     and server implementation of the SSHv2 protocol on top of the Python     3.4+ asyncio framework. It has been discovered that it is vulnerable to

    CVE-2023-46445

        A vulnerability has been discovered that allows attackers to control         the extension info message (RFC 8308) via a man-in-the-middle attack         (aka Rogue Extension Negotiation).

    CVE-2023-46446

        A vulnerability has been discovered that allows attackers to control         the remote end of an SSH client session via packet injection/removal         and shell emulation (aka Rogue Session attack).

    CVE-2023-48795

        A vulnerability has been discovered allows remote attackers to bypass         integrity checks, and a client and server may consequently end up with         a connection for which some security features have been downgraded or         disabled (aka Terrapin attack).

    For Debian 11 bullseye, these problems have been fixed in version     2.5.0-0.1+deb11u1.

    We recommend that you upgrade your python-asyncssh packages.

    For the detailed security status of python-asyncssh please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-asyncssh

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

    Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-d2956318e4 advisory.

    Security fix for CVE-2023-46446 and CVE-2023-46445

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
258350	Linux Distros Unpatched Vulnerability : CVE-2023-46446	Nessus	Misc.	Local	medium
239507	TencentOS Server 4: python-asyncssh (TSSA-2024:1054)	Nessus	Tencent Local Security Checks	Local	medium
235495	RHEL 8 / 9 : Red Hat Ceph Storage 7.1 (RHSA-2025:4664)	Nessus	Red Hat Local Security Checks	Local	medium
413607	SCA: security update for asyncssh (GHSA-c35q-ffpf-5qpm)	Tenable Cloud Security	SCA Checks	Local	medium
413607	SCA: security update for asyncssh (GHSA-c35q-ffpf-5qpm)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
212697	Ubuntu 18.04 LTS : AsyncSSH vulnerabilities (USN-7108-2)	Nessus	Ubuntu Local Security Checks	Local	medium
210948	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : AsyncSSH vulnerabilities (USN-7108-1)	Nessus	Ubuntu Local Security Checks	Local	medium
207872	Debian dla-3899 : python-asyncssh-doc - security update	Nessus	Debian Local Security Checks	Local	critical
186277	Fedora 39 : python-asyncssh (2023-d2956318e4)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2023-46446

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

critical

medium