Bug 1218165

Summary:	VUL-0: CVE-2023-48795: python-asyncssh: prefix truncation breaking ssh channel integrity aka Terrapin Attack
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Marcus Meissner <meissner>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Critical
Priority:	P3 - Medium	CC:	gus.kenion, hpj, meissner, ncutler, rfrohl, sascha.wessels, security-team, smash_bz, sreeves, stoyan.manolov
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/387549/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:
Bug Blocks:	1217950

Description Marcus Meissner 2023-12-18 15:51:17 UTC

This update tracks the python-asyncssh parts of the Terrapin attack.

Dirk, while you are not registered as maintainer, perhaps you can take this bug and update pytnon-asyncssh when it arrives.

i so far only found it in openSUSE Factory.

Comment 1 Dirk Mueller 2023-12-18 16:07:13 UTC

fix is submitted to factory.

Comment 2 OBSbugzilla Bot 2023-12-18 17:35:03 UTC

This is an autogenerated message for OBS integration:
This bug (1218165) was mentioned in
https://build.opensuse.org/request/show/1133889 Factory / python-asyncssh

Comment 3 Dirk Mueller 2023-12-19 07:23:07 UTC

merged.