Executive brief
An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation.
Affected products
- PyPI asyncssh
Junglewise Threat Intelligence
CVE-2023-46446: PYSEC-2023-239 - An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the remote end of an SSH client session via packet injection/removal an
CVE-2023-46446 · Severity: low · CVSS 3.1 · Published 2023-11-14
Technologies: asyncssh (PyPI). Vendors: PyPI.
Related threats
- ronf AsyncSSH path traversal in AuthorizedKeysFile
- AsyncSSH path traversal in SCP client
- ronf AsyncSSH path traversal in AuthorizedKeysFile username substitution
- PYSEC-2023-237 - An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack.
- PYSEC-2018-108 - The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other