CVE-2023-48795

NameCVE-2023-48795
DescriptionThe SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3694-1, DLA-3718-1, DLA-3719-1, DLA-3730-1, DLA-3794-1, DLA-3899-1, DLA-3975-1, DSA-5586-1, DSA-5588-1, DSA-5591-1, DSA-5599-1, DSA-5600-1, DSA-5601-1, DSA-5750-1, ELA-1038-1, ELA-1045-1, ELA-1050-1
Debian Bugs1059001, 1059002, 1059003, 1059004, 1059005, 1059006, 1059007, 1059058, 1059144, 1059290, 1059294

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
dropbear (PTS)jessie, jessie (lts)2014.65-1+deb8u3vulnerable
stretch2016.74-5+deb9u1vulnerable
buster (security), buster, buster (lts)2018.76-5+deb10u2fixed
bullseye2020.81-3+deb11u2fixed
bookworm2022.83-1+deb12u2fixed
sid, trixie2024.86-1fixed
erlang (PTS)jessie, jessie (lts)1:17.3-dfsg-4+deb8u2vulnerable
stretch (security)1:19.2.1+dfsg-2+deb9u1vulnerable
stretch (lts), stretch1:19.2.1+dfsg-2+really23.3.4.18-0+deb9u2vulnerable
buster (security), buster, buster (lts)1:22.2.7+dfsg-1+deb10u1vulnerable
bullseye1:23.2.6+dfsg-1+deb11u1vulnerable
bookworm1:25.2.3+dfsg-1vulnerable
trixie1:25.3.2.12+dfsg-3fixed
sid1:27.1.2+dfsg-1fixed
filezilla (PTS)jessie3.9.0.5-1vulnerable
stretch (security), stretch (lts), stretch3.24.0-1+deb9u1vulnerable
buster3.39.0-2+deb10u1fixed
bullseye3.52.2-3+deb11u1fixed
bookworm3.63.0-1+deb12u3fixed
sid, trixie3.68.0-1fixed
golang-go.crypto (PTS)jessie, jessie (lts)0.0~hg190-1+deb8u2vulnerable
stretch (security), stretch (lts), stretch1:0.0~git20170407.0.55a552f+REALLY.0.0~git20161012.0.5f31782-1+deb8u1vulnerable
buster (security), buster, buster (lts)1:0.0~git20181203.505ab14-1+deb10u1vulnerable
bullseye1:0.0~git20201221.eec23a3-1vulnerable
bookworm1:0.4.0-1vulnerable
sid, trixie1:0.25.0-1fixed
jsch (PTS)jessie, jessie (lts)0.1.51-1+deb8u1fixed
stretch0.1.54-1fixed
buster, bullseye, bookworm0.1.55-1fixed
sid, trixie0.2.19-1fixed
libssh (PTS)jessie, jessie (lts)0.6.3-4+deb8u6vulnerable
stretch (security)0.7.3-2+deb9u3vulnerable
stretch (lts), stretch0.7.3-2+deb9u4vulnerable
buster (security), buster, buster (lts)0.8.7-1+deb10u2vulnerable
bullseye (security), bullseye0.9.8-0+deb11u1fixed
bookworm (security), bookworm0.10.6-0+deb12u1fixed
sid, trixie0.11.1-1fixed
libssh2 (PTS)jessie, jessie (lts)1.4.3-4.1+deb8u7fixed
stretch (security)1.7.0-1+deb9u2fixed
stretch (lts), stretch1.7.0-1+deb9u3fixed
buster (security), buster, buster (lts)1.8.0-2.1+deb10u1fixed
bullseye1.9.0-2+deb11u1fixed
bookworm1.10.0-3fixed
sid, trixie1.11.1-1fixed
openssh (PTS)jessie, jessie (lts)1:6.7p1-5+deb8u10vulnerable
stretch (security)1:7.4p1-10+deb9u6vulnerable
stretch (lts), stretch1:7.4p1-10+deb9u9fixed
buster (security), buster, buster (lts)1:7.9p1-10+deb10u4fixed
bullseye (security), bullseye1:8.4p1-5+deb11u3fixed
bookworm (security), bookworm1:9.2p1-2+deb12u3fixed
sid, trixie1:9.9p1-3fixed
paramiko (PTS)jessie, jessie (lts)1.15.1-1+deb8u2fixed
stretch (security), stretch (lts), stretch2.0.0-1+deb9u2fixed
buster (security), buster, buster (lts)2.4.2-0.1+deb10u1fixed
bullseye2.7.2-1vulnerable
bookworm2.12.0-2vulnerable
sid, trixie3.4.1-2fixed
php-phpseclib (PTS)stretch (lts), stretch2.0.30-2~deb9u1fixed
buster (security), buster, buster (lts)2.0.30-2~deb10u3fixed
bullseye2.0.30-2+deb11u2fixed
bullseye (security)2.0.30-2+deb11u1fixed
bookworm2.0.42-1+deb12u2fixed
bookworm (security)2.0.42-1+deb12u1fixed
sid, trixie2.0.47-3fixed
php-phpseclib3 (PTS)bookworm3.0.19-1+deb12u3fixed
bookworm (security)3.0.19-1+deb12u2fixed
sid, trixie3.0.42-1fixed
phpseclib (PTS)jessie0.3.8-1vulnerable
stretch (lts), stretch1.0.19-1~deb9u2fixed
buster (security), buster, buster (lts)1.0.19-3~deb10u3fixed
bullseye1.0.19-3+deb11u2fixed
bullseye (security)1.0.19-3+deb11u1fixed
bookworm1.0.20-1+deb12u2fixed
bookworm (security)1.0.20-1+deb12u1fixed
sid, trixie1.0.23-3fixed
proftpd-dfsg (PTS)jessie, jessie (lts)1.3.5e+r1.3.5-2+deb8u8vulnerable
stretch (security)1.3.5e+r1.3.5b-4+deb9u2vulnerable
stretch (lts), stretch1.3.5e+r1.3.5b-4+deb9u3vulnerable
buster1.3.6-4+deb10u6vulnerable
buster (security), buster (lts)1.3.6-4+deb10u4vulnerable
bullseye1.3.7a+dfsg-12+deb11u2vulnerable
bullseye (security)1.3.7a+dfsg-12+deb11u3fixed
bookworm1.3.8+dfsg-4+deb12u3fixed
bookworm (security)1.3.8+dfsg-4+deb12u4fixed
sid, trixie1.3.8.c+dfsg-1fixed
proftpd-mod-proxy (PTS)bullseye0.7-1vulnerable
bookworm0.9.2-1+deb12u1fixed
sid, trixie0.9.4-1fixed
putty (PTS)jessie, jessie (lts)0.63-10+deb8u2fixed
stretch (security), stretch (lts), stretch0.67-3+deb9u1fixed
buster (security), buster, buster (lts)0.74-1+deb11u1~deb10u2fixed
bullseye0.74-1+deb11u2fixed
bullseye (security)0.74-1+deb11u1fixed
bookworm0.78-2+deb12u2fixed
bookworm (security)0.78-2+deb12u1fixed
sid, trixie0.82-2fixed
python-asyncssh (PTS)buster (security), buster, buster (lts)1.12.2-1+deb10u1fixed
bullseye2.5.0-0.1vulnerable
bullseye (security)2.5.0-0.1+deb11u1fixed
bookworm (security), bookworm2.10.1-2+deb12u1fixed
sid, trixie2.19.0-1fixed
tinyssh (PTS)buster20190101-1vulnerable
bullseye20190101-1+deb11u1vulnerable
bookworm20230101-1vulnerable
sid, trixie20241201-1fixed
trilead-ssh2 (PTS)jessie6401+svn158-0.1vulnerable
buster, stretch6401+svn158-1vulnerable
sid, bullseye, trixie, bookworm6401+svn158-1.1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
dropbearsourcejessie(unfixed)end-of-life
dropbearsourcestretch(unfixed)end-of-life
dropbearsourcebuster(not affected)
dropbearsourcebullseye2020.81-3+deb11u1
dropbearsourcebookworm2022.83-1+deb12u1
dropbearsource(unstable)2022.83-41059001
erlangsourcejessie(unfixed)end-of-life
erlangsource(unstable)1:25.3.2.8+dfsg-11059002
filezillasourcejessie(unfixed)end-of-life
filezillasourcebuster(not affected)
filezillasourcebullseye3.52.2-3+deb11u1
filezillasourcebookworm3.63.0-1+deb12u3
filezillasource(unstable)3.66.4-1
golang-go.cryptosourcejessie(unfixed)end-of-life
golang-go.cryptosourcestretch(unfixed)end-of-life
golang-go.cryptosource(unstable)1:0.17.0-11059003
jschsource(unstable)(not affected)
libsshsourcejessie(unfixed)end-of-life
libsshsourcebullseye0.9.8-0+deb11u1DSA-5591-1
libsshsourcebookworm0.10.6-0+deb12u1DSA-5591-1
libsshsource(unstable)0.10.6-11059004
libssh2sourcejessie(not affected)
libssh2sourcestretch(not affected)
libssh2sourcebuster(not affected)
libssh2sourcebullseye(not affected)
libssh2sourcebookworm(not affected)
libssh2source(unstable)1.11.0-41059005
opensshsourcestretch1:7.4p1-10+deb9u9ELA-1038-1
opensshsourcebuster1:7.9p1-10+deb10u4DLA-3694-1
opensshsourcebullseye1:8.4p1-5+deb11u3DSA-5586-1
opensshsourcebookworm1:9.2p1-2+deb12u2DSA-5586-1
opensshsource(unstable)1:9.6p1-1
paramikosourcejessie(not affected)
paramikosourcestretch(not affected)
paramikosourcebuster(not affected)
paramikosource(unstable)3.4.0-11059006
php-phpseclibsourcestretch2.0.30-2~deb9u1ELA-1050-1
php-phpseclibsourcebuster2.0.30-2~deb10u2DLA-3718-1
php-phpseclibsourcebullseye2.0.30-2+deb11u1DSA-5600-1
php-phpseclibsourcebookworm2.0.42-1+deb12u1DSA-5600-1
php-phpseclibsource(unstable)2.0.46-1
php-phpseclib3sourcebookworm3.0.19-1+deb12u2DSA-5601-1
php-phpseclib3source(unstable)3.0.35-1
phpseclibsourcejessie(unfixed)end-of-life
phpseclibsourcestretch1.0.19-1~deb9u2ELA-1045-1
phpseclibsourcebuster1.0.19-3~deb10u2DLA-3719-1
phpseclibsourcebullseye1.0.19-3+deb11u1DSA-5599-1
phpseclibsourcebookworm1.0.20-1+deb12u1DSA-5599-1
phpseclibsource(unstable)1.0.22-1
proftpd-dfsgsourcejessie(unfixed)end-of-life
proftpd-dfsgsourcebullseye1.3.7a+dfsg-12+deb11u3DLA-3975-1
proftpd-dfsgsourcebookworm1.3.8+dfsg-4+deb12u3
proftpd-dfsgsource(unstable)1.3.8.b+dfsg-11059144
proftpd-mod-proxysourcebookworm0.9.2-1+deb12u1
proftpd-mod-proxysource(unstable)0.9.3-11059290
puttysourcejessie(not affected)
puttysourcestretch(not affected)
puttysourcebuster0.74-1+deb11u1~deb10u1DLA-3794-1
puttysourcebullseye0.74-1+deb11u1DSA-5588-1
puttysourcebookworm0.78-2+deb12u1DSA-5588-1
puttysource(unstable)0.80-1
python-asyncsshsourcebuster1.12.2-1+deb10u1DLA-3730-1
python-asyncsshsourcebullseye2.5.0-0.1+deb11u1DLA-3899-1
python-asyncsshsourcebookworm2.10.1-2+deb12u1DSA-5750-1
python-asyncsshsource(unstable)2.15.0-11059007
tinysshsource(unstable)20230101-4unimportant1059058
trilead-ssh2sourcejessie(unfixed)end-of-life
trilead-ssh2sourcestretch(unfixed)end-of-life
trilead-ssh2source(unstable)(unfixed)1059294

Notes

[buster] - dropbear <not-affected> (ChaCha20-Poly1305 support introduced in 2020.79; *-EtM not supported as of 2022.83)
[bookworm] - erlang <no-dsa> (Minor issue)
[bullseye] - erlang <no-dsa> (Minor issue)
[buster] - erlang <no-dsa> (Minor issue)
[buster] - filezilla <not-affected> (OpenSSH extension in question not implemented)
[bookworm] - golang-go.crypto <no-dsa> (Minor issue)
[bullseye] - golang-go.crypto <no-dsa> (Minor issue)
[buster] - golang-go.crypto <postponed> (Limited support, minor issue, follow bullseye DSAs/point-releases)
- jsch <not-affected> (ChaCha20-Poly1305 support introduced in 0.1.61; *-EtM support introduced in 0.1.58)
[bookworm] - libssh2 <not-affected> (ChaCha20-Poly1305 and CBC-EtM support not present)
[bullseye] - libssh2 <not-affected> (ChaCha20-Poly1305 and CBC-EtM support not present)
[buster] - libssh2 <not-affected> (ChaCha20-Poly1305 and CBC-EtM support not present)
[bookworm] - paramiko <ignored> (Minor issue)
[bullseye] - paramiko <no-dsa> (Minor issue)
[buster] - paramiko <not-affected> (ChaCha20-Poly1305 and CBC-EtM support not present)
[buster] - proftpd-dfsg <no-dsa> (Minor issue)
[bullseye] - proftpd-mod-proxy <ignored> (Minor issue)
[bookworm] - trilead-ssh2 <ignored> (Minor issue)
[bullseye] - trilead-ssh2 <no-dsa> (Minor issue)
[buster] - trilead-ssh2 <no-dsa> (Minor issue)
https://terrapin-attack.com/
https://www.openwall.com/lists/oss-security/2023/12/18/3
dropbear: https://github.com/mkj/dropbear/commit/6e43be5c7b99dbee49dc72b6f989f29fdd7e9356
Erlang/OTP: https://github.com/erlang/otp/commit/ee67d46285394db95133709cef74b0c462d665aa (OTP-24.3.4.15, OTP-25.3.2.8, OTP-26.2.1)
filezilla: https://svn.filezilla-project.org/filezilla?view=revision&revision=11047
filezilla: https://svn.filezilla-project.org/filezilla?view=revision&revision=11048
filezilla: https://svn.filezilla-project.org/filezilla?view=revision&revision=11049
golang.org/x/crypto/ssh: https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg
golang.org/x/crypto/ssh: https://github.com/golang/go/issues/64784
golang.org/x/crypto/ssh: https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d (v0.17.0)
jsch: https://github.com/mwiede/jsch/issues/457
jsch: https://github.com/norrisjeremy/jsch/commit/6214da974286a8b94a95f4cf6cec96e972ffd370 (jsch-0.2.15)
libssh: https://www.libssh.org/security/advisories/CVE-2023-48795.txt
libssh: https://gitlab.com/libssh/libssh-mirror/-/commit/4cef5e965a46e9271aed62631b152e4bd23c1e3c (libssh-0.10.6)
libssh: https://gitlab.com/libssh/libssh-mirror/-/commit/0870c8db28be9eb457ee3d4f9a168959d9507efd (libssh-0.10.6)
libssh: https://gitlab.com/libssh/libssh-mirror/-/commit/5846e57538c750c5ce67df887d09fa99861c79c6 (libssh-0.10.6)
libssh: https://gitlab.com/libssh/libssh-mirror/-/commit/89df759200d31fc79fbbe213d8eda0d329eebf6d (libssh-0.10.6)
libssh2: https://github.com/libssh2/libssh2/issues/1290
libssh2: https://github.com/libssh2/libssh2/pull/1291
libssh2: https://github.com/libssh2/libssh2/commit/d34d9258b8420b19ec3f97b4cc5bf7aa7d98e35a
OpenSSH: https://www.openwall.com/lists/oss-security/2023/12/18/2
OpenSSH (strict key exchange): https://github.com/openssh/openssh-portable/commit/1edb00c58f8a6875fad6a497aa2bacf37f9e6cd5 (V_9_6_P1)
paramiko: https://github.com/paramiko/paramiko/issues/2337
phpseclib: https://github.com/phpseclib/phpseclib/issues/1972
phpseclib: https://github.com/phpseclib/phpseclib/commit/c8e3ab9317abae80d7f58fd9acd9214b57572b32 (1.0.22, 2.0.46, 3.0.35)
proftpd: https://github.com/proftpd/proftpd/issues/1760
proftpd: https://github.com/proftpd/proftpd/commit/7fba68ebb3ded3047a35aa639e115eba7d585682 (v1.3.9rc2)
proftpd: https://github.com/proftpd/proftpd/commit/bcec15efe6c53dac40420731013f1cd2fd54123b (v1.3.8b)
proftpd-mod-proxy: https://github.com/Castaglia/proftpd-mod_proxy/issues/257
proftpd-mod-proxy: https://github.com/Castaglia/proftpd-mod_proxy/commit/54612735629231de2242d6395d334539604872fb (v0.9.3)
PuTTY: https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-terrapin.html
PuTTY: https://git.tartarus.org/?p=simon/putty.git;a=commit;h=9e099151574885f3c717ac10a633a9218db8e7bb (0.80)
PuTTY: https://git.tartarus.org/?p=simon/putty.git;a=commit;h=f2e7086902b3605c96e54ef9c956ca7ab000010e (0.80)
PuTTY: https://git.tartarus.org/?p=simon/putty.git;a=commit;h=9fcbb86f715bc03e58921482efe663aa0c662d62 (0.80)
PuTTY: https://git.tartarus.org/?p=simon/putty.git;a=commit;h=244be5412728a7334a2d457fbac4e0a2597165e5 (0.80)
PuTTY: https://git.tartarus.org/?p=simon/putty.git;a=commit;h=58fc33a155ad496bdcf380fa6193302240a15ae9 (0.80)
PuTTY: https://git.tartarus.org/?p=simon/putty.git;a=commit;h=0b00e4ce26d89cd010e31e66fd02ac77cb982367 (0.80)
PuTTY: https://git.tartarus.org/?p=simon/putty.git;a=commit;h=fdc891d17063ab26cf68c74245ab1fd9771556cb (0.80)
PuTTY: https://git.tartarus.org/?p=simon/putty.git;a=commit;h=b80a41d386dbfa1b095c17bd2ed001477f302d46 (0.80)
asyncssh: https://github.com/ronf/asyncssh/security/advisories/GHSA-hfmc-7525-mj55
asyncssh: https://github.com/ronf/asyncssh/commit/0bc73254f41acb140187e0c89606311f88de5b7b (v2.14.2)
tinyssh: https://github.com/janmojzis/tinyssh/issues/81
tinyssh: https://github.com/janmojzis/tinyssh/commit/ebaa1bd23c2c548af70cc8151e85c74f4c8594bb
tinyssh: 20230101-4 implements kex-strict-s-v00@openssh.com for the strict kex support. But
tinyssh: since there is no support for EXT_INFO in tinyssh, even with the present
tinyssh: chacha20-poly1305@openssh.com encryption algorith, there is no downgrade of the
tinyssh: connection security.
[stretch] - erlang <no-dsa> (Minor issue)
[stretch] - filezilla <no-dsa> (Minor issue)
[stretch] - libssh2 <not-affected> (Vulnerable ciphers not yet implemented)
[jessie] - libssh2 <not-affected> (Vulnerable ciphers not yet implemented)
[jessie] - openssh <ignored> (Too intrusive to backport; workaround available)
[stretch] - paramiko <not-affected> (Vulnerable ciphers not yet implemented)
[jessie] - paramiko <not-affected> (Vulnerable ciphers not yet implemented)
[stretch] - proftpd-dfsg <no-dsa> (Minor issue)
[stretch] - putty <not-affected> (ChaCha20-Poly1305 and encrypt-then-MAC support added in 0.68)
[jessie] - putty <not-affected> (ChaCha20-Poly1305 and encrypt-then-MAC support added in 0.68)

Search for package or bug name: Reporting problems