Vulnerabilities for asyncssh

First version without a known vulnerability: 2.14.2

Details

• GHSA-g794-3fmp-753h2026-05-27

  AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username

  Fixed in: 2.23.0

• GHSA-hfmc-7525-mj552023-12-18

  AsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC

  Fixed in: 2.14.2

• GHSA-c35q-ffpf-5qpm2023-11-09

  AsyncSSH Rogue Session Attack

  Fixed in: 2.14.1

• GHSA-cfc2-wr2v-gxm52023-11-09

  AsyncSSH Rogue Extension Negotiation

  Fixed in: 2.14.1

• GHSA-97cv-6pjf-5f9q2022-05-14

  AsyncSSH SSH Server Authentication Bypass

  Fixed in: 1.12.1, c161e26cdc0d41b745b63d9f17b437f073bf7ba4