CVE-2023-48795: OpenSSH and others SSH prefix truncation vulnerability (Terrapin)

CVE-2023-48795 · Severity: medium · CVSS 5.9 · Published 2023-12-18

A vulnerability in the SSH protocol, known as Terrapin, allows an attacker positioned between a client and a server to silently drop security-related messages during the initial connection setup. This can be used to downgrade the connection's security features or disable certain defenses without either party noticing. While it does not allow for full decryption of the session, it weakens the overall protection of the encrypted tunnel used for remote access and data transfer.

Technologies: russh (crates.io), golang.org/x/crypto (Go), Libssh, Libssh2, Paramiko, Putty, paramiko (PyPI). Vendors: crates.io, Go, Libssh, Libssh2, Paramiko, Putty, PyPI.

Quick answers

Is CVE-2023-48795 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-48795 being exploited in the wild.
How severe is CVE-2023-48795?
Medium severity, with a CVSS score of 5.9, published 18 December 2023.
Which products and versions are affected?
russh (crates.io) SEMVER:introduced=0,fixed=0.40.2; Filezilla-Project FileZilla < 3.66.4; golang.org/x/crypto (Go) SEMVER:introduced=0,fixed=0.17.0, SEMVER:introduced=0.1.0,fixed=0.17.0; Libssh < 0.10.6; and 5 more.
Is there a fix for CVE-2023-48795?
Yes. russh (crates.io): upgrade to 0.40.2 or later; golang.org/x/crypto (Go): upgrade to 0.17.0 or later; paramiko (PyPI): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-48795 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-48795?
Check whether you run russh (crates.io), Filezilla-Project FileZilla, golang.org/x/crypto (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • russh (crates.io): upgrade to 0.40.2 or later
    cargo update -p russh
  • golang.org/x/crypto (Go): upgrade to 0.17.0 or later
    go get golang.org/x/crypto@v0.17.0
  • paramiko (PyPI): upgrade to 3.4.0 or later
    pip install "paramiko>=3.4.0"

Technical details

The Terrapin attack exploits a flaw in the SSH transport layer protocol when using specific encryption modes like ChaCha20-Poly1305 or Encrypt-then-MAC (EtM) with CBC. By injecting 'SSH_MSG_IGNORE' messages during the initial unauthenticated handshake and subsequently removing an equal number of encrypted packets after the key exchange, a Man-in-the-Middle (MitM) attacker can truncate the beginning of the secure channel. This is possible because sequence numbers are not authenticated until after the handshake is complete. The attack can be used to strip 'SSH_MSG_EXT_INFO' messages, effectively downgrading extension negotiation and disabling security features like keystroke obfuscation. Mitigation requires both client and server to implement the 'strict key exchange' (strict kex) extension.

Affected products

  • golang.org/x/ crypto >= 0.1.0, < 0.17.0
  • pip paramiko >= 2.5.0, < 3.4.0
  • cargo russh < 0.40.2
  • OpenSSH OpenSSH < 9.6

Identifiers

  • CVE-2023-48795
  • GHSA-45x7-px36-x8w8
  • GO-2023-2402
  • PYSEC-2026-1758

Timeline

  • 2023-12-18: disclosed: Public disclosure of the Terrapin attack.
  • 2023-12-18: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.