Skip to content
Fencer Vulns
medium 6.8

CVE-2023-46446 json

AsyncSSH Rogue Session Attack

published 2023-11-09 2 y ago modified 2026-07-08 4 mo ago also GHSA-c35q-ffpf-5qpm , PYSEC-2023-239 , EUVD-2023-0046

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 58%
public exploits
0
none known

Summary

An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."

Patch / fix

  • pypi asyncssh 2.14.1
  • asyncssh_project asyncssh 2.14.1
  • python-asyncssh Debian 12 2.10.1-2+deb12u2
  • python-asyncssh Debian 14, Debian 13 2.15.0-1

debian advisories DEBIAN-CVE-2023-46446

  • python-asyncssh Ubuntu 20.04 LTS 1.12.2-1ubuntu0.2
  • python-asyncssh Ubuntu 22.04 LTS 2.5.0-1ubuntu0.1
  • python-asyncssh Ubuntu Pro 18.04 LTS 1.11.1-1ubuntu0.1~esm2
  • python-asyncssh Ubuntu Pro 24.04 LTS 2.10.1-2ubuntu0.1+esm1

ubuntu advisories UBUNTU-CVE-2023-46446

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ceph ceph storage 7.1 2:18.2.1-329.el8cp
  • ceph ceph storage 7.1 2:18.2.1-329.el9cp
  • cephadm ceph storage 7.1 2:18.2.1-329.el9cp
  • liboath ceph storage 7.1 2.6.12-1.el8cp
  • liboath ceph storage 7.1 2.6.12-1.el9cp
  • librbd1 ceph storage 7.1 2:18.2.1-329.el8cp
  • librbd1 ceph storage 7.1 2:18.2.1-329.el9cp
  • librgw2 ceph storage 7.1 2:18.2.1-329.el8cp

red hat advisories RHSA-2025:4664

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-46446 updated cvss 6.8

python-asyncssh: Rogue Session Attack

  • Red Hat Ceph Storage 6 python-asyncssh
    affected: no fix available
  • Red Hat Ceph Storage 7.1 Tools liboath 2.6.12-1.el8cp, liboath 2.6.12-1.el9cp, oath-toolkit 2.6.12-1.el8cp, oath-toolkit 2.6.12-1.el9cp
    fixed: vendor fix RHSA-2025:4664
  • Red Hat Ceph Storage 7.1 Tools ceph 18.2.1-329.el8cp, ceph 18.2.1-329.el9cp, cephadm 18.2.1-329.el9cp, librbd1 18.2.1-329.el8cp, librbd1 18.2.1-329.el9cp, librgw2 18.2.1-329.el8cp, +37 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.87% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
OSV 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
pypi asyncssh
<2.14.1
2.14.1

Classification

Weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key
  • CWE-345 Insufficient Verification of Data Authenticity
  • CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data
  • CWE-354 Improper Validation of Integrity Check Value
  • CWE-359 Exposure of Private Personal Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.