CVE-2023-48795

Vulnerable and fixed packages

The table below lists information on source packages.

The information below is based on the following data on fixed versions.

Notes

[buster] - dropbear <not-affected> (ChaCha20-Poly1305 support introduced in 2020.79; *-EtM not supported as of 2022.83)
[bookworm] - erlang <no-dsa> (Minor issue)
[bullseye] - erlang <no-dsa> (Minor issue)
[buster] - erlang <no-dsa> (Minor issue)
[buster] - filezilla <not-affected> (OpenSSH extension in question not implemented)
[bookworm] - golang-go.crypto <no-dsa> (Minor issue)
[bullseye] - golang-go.crypto <no-dsa> (Minor issue)
[buster] - golang-go.crypto <postponed> (Limited support, minor issue, follow bullseye DSAs/point-releases)
- jsch <not-affected> (ChaCha20-Poly1305 support introduced in 0.1.61; *-EtM support introduced in 0.1.58)
[bookworm] - libssh2 <not-affected> (ChaCha20-Poly1305 and CBC-EtM support not present)
[bullseye] - libssh2 <not-affected> (ChaCha20-Poly1305 and CBC-EtM support not present)
[buster] - libssh2 <not-affected> (ChaCha20-Poly1305 and CBC-EtM support not present)
[bookworm] - paramiko <no-dsa> (Minor issue)
[bullseye] - paramiko <no-dsa> (Minor issue)
[buster] - paramiko <not-affected> (ChaCha20-Poly1305 and CBC-EtM support not present)
[bullseye] - proftpd-dfsg <no-dsa> (Minor issue)
[buster] - proftpd-dfsg <no-dsa> (Minor issue)
[bullseye] - proftpd-mod-proxy <no-dsa> (Minor issue)
[bookworm] - trilead-ssh2 <no-dsa> (Minor issue)
[bullseye] - trilead-ssh2 <no-dsa> (Minor issue)
[buster] - trilead-ssh2 <no-dsa> (Minor issue)
https://terrapin-attack.com/
https://www.openwall.com/lists/oss-security/2023/12/18/3
dropbear: https://github.com/mkj/dropbear/commit/6e43be5c7b99dbee49dc72b6f989f29fdd7e9356
Erlang/OTP: https://github.com/erlang/otp/commit/ee67d46285394db95133709cef74b0c462d665aa (OTP-24.3.4.15, OTP-25.3.2.8, OTP-26.2.1)
filezilla: https://svn.filezilla-project.org/filezilla?view=revision&revision=11047
filezilla: https://svn.filezilla-project.org/filezilla?view=revision&revision=11048
filezilla: https://svn.filezilla-project.org/filezilla?view=revision&revision=11049
golang.org/x/crypto/ssh: https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg
golang.org/x/crypto/ssh: https://github.com/golang/go/issues/64784
golang.org/x/crypto/ssh: https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d (v0.17.0)
jsch: https://github.com/mwiede/jsch/issues/457
jsch: https://github.com/norrisjeremy/jsch/commit/6214da974286a8b94a95f4cf6cec96e972ffd370 (jsch-0.2.15)
libssh: https://www.libssh.org/security/advisories/CVE-2023-48795.txt
libssh: https://gitlab.com/libssh/libssh-mirror/-/commit/4cef5e965a46e9271aed62631b152e4bd23c1e3c (libssh-0.10.6)
libssh: https://gitlab.com/libssh/libssh-mirror/-/commit/0870c8db28be9eb457ee3d4f9a168959d9507efd (libssh-0.10.6)
libssh: https://gitlab.com/libssh/libssh-mirror/-/commit/5846e57538c750c5ce67df887d09fa99861c79c6 (libssh-0.10.6)
libssh: https://gitlab.com/libssh/libssh-mirror/-/commit/89df759200d31fc79fbbe213d8eda0d329eebf6d (libssh-0.10.6)
libssh2: https://github.com/libssh2/libssh2/issues/1290
libssh2: https://github.com/libssh2/libssh2/pull/1291
libssh2: https://github.com/libssh2/libssh2/commit/d34d9258b8420b19ec3f97b4cc5bf7aa7d98e35a
OpenSSH: https://www.openwall.com/lists/oss-security/2023/12/18/2
OpenSSH (strict key exchange): https://github.com/openssh/openssh-portable/commit/1edb00c58f8a6875fad6a497aa2bacf37f9e6cd5 (V_9_6_P1)
paramiko: https://github.com/paramiko/paramiko/issues/2337
phpseclib: https://github.com/phpseclib/phpseclib/issues/1972
phpseclib: https://github.com/phpseclib/phpseclib/commit/c8e3ab9317abae80d7f58fd9acd9214b57572b32 (1.0.22, 2.0.46, 3.0.35)
proftpd: https://github.com/proftpd/proftpd/issues/1760
proftpd: https://github.com/proftpd/proftpd/commit/7fba68ebb3ded3047a35aa639e115eba7d585682 (v1.3.9rc2)
proftpd: https://github.com/proftpd/proftpd/commit/bcec15efe6c53dac40420731013f1cd2fd54123b (v1.3.8b)
proftpd-mod-proxy: https://github.com/Castaglia/proftpd-mod_proxy/issues/257
proftpd-mod-proxy: https://github.com/Castaglia/proftpd-mod_proxy/commit/54612735629231de2242d6395d334539604872fb (v0.9.3)
PuTTY: https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-terrapin.html
PuTTY: https://git.tartarus.org/?p=simon/putty.git;a=commit;h=9e099151574885f3c717ac10a633a9218db8e7bb (0.80)
PuTTY: https://git.tartarus.org/?p=simon/putty.git;a=commit;h=f2e7086902b3605c96e54ef9c956ca7ab000010e (0.80)
PuTTY: https://git.tartarus.org/?p=simon/putty.git;a=commit;h=9fcbb86f715bc03e58921482efe663aa0c662d62 (0.80)
PuTTY: https://git.tartarus.org/?p=simon/putty.git;a=commit;h=244be5412728a7334a2d457fbac4e0a2597165e5 (0.80)
PuTTY: https://git.tartarus.org/?p=simon/putty.git;a=commit;h=58fc33a155ad496bdcf380fa6193302240a15ae9 (0.80)
PuTTY: https://git.tartarus.org/?p=simon/putty.git;a=commit;h=0b00e4ce26d89cd010e31e66fd02ac77cb982367 (0.80)
PuTTY: https://git.tartarus.org/?p=simon/putty.git;a=commit;h=fdc891d17063ab26cf68c74245ab1fd9771556cb (0.80)
PuTTY: https://git.tartarus.org/?p=simon/putty.git;a=commit;h=b80a41d386dbfa1b095c17bd2ed001477f302d46 (0.80)
asyncssh: https://github.com/ronf/asyncssh/security/advisories/GHSA-hfmc-7525-mj55
asyncssh: https://github.com/ronf/asyncssh/commit/0bc73254f41acb140187e0c89606311f88de5b7b (v2.14.2)
tinyssh: https://github.com/janmojzis/tinyssh/issues/81
tinyssh: https://github.com/janmojzis/tinyssh/commit/ebaa1bd23c2c548af70cc8151e85c74f4c8594bb
tinyssh: 20230101-4 implements kex-strict-s-v00@openssh.com for the strict kex support. But
tinyssh: since there is no support for EXT_INFO in tinyssh, even with the present
tinyssh: chacha20-poly1305@openssh.com encryption algorith, there is no downgrade of the
tinyssh: connection security.
[stretch] - erlang <no-dsa> (Minor issue)
[stretch] - filezilla <no-dsa> (Minor issue)
[stretch] - libssh2 <not-affected> (Vulnerable ciphers not yet implemented)
[jessie] - libssh2 <not-affected> (Vulnerable ciphers not yet implemented)
[jessie] - openssh <ignored> (Too intrusive to backport; workaround available)
[stretch] - paramiko <not-affected> (Vulnerable ciphers not yet implemented)
[jessie] - paramiko <not-affected> (Vulnerable ciphers not yet implemented)
[stretch] - proftpd-dfsg <no-dsa> (Minor issue)
[stretch] - putty <not-affected> (ChaCha20-Poly1305 and encrypt-then-MAC support added in 0.68)
[jessie] - putty <not-affected> (ChaCha20-Poly1305 and encrypt-then-MAC support added in 0.68)