An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade python-asyncssh | Sep 30, 2024 | Nov 14, 2023 |
| Progress Moveit Transfer | — | Disable vulnerable SSH algorithms in Progress MOVEit Transfer to mitigate the Terrapin vulnerability by updating the SFTP/SSH configuration to disable weak ciphers and MAC algorithms such as [email protected], aes128-cbc, aes192-cbc, aes256-cbc, and Encrypt-then-MAC (EtM) algorithms including [email protected] and [email protected], which are susceptible to SSH handshake manipulation; instead, allow only secure algorithms such as AES-GCM-based ciphers and restart MOVEit Transfer services for changes to take effect. | Nov 27, 2025 | Dec 21, 2023 |
| Ubuntu | — | Upgrade python3-asyncsshUpgrade python3-asyncssh (Ubuntu Pro) | Nov 19, 2024 | Nov 14, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub