MNBSD-2023-10: OpenSSH Prefix Truncation Attack in the SSH protocol

Description

A man in the middle attacker can silently manipulate handshake messages to truncate extension negotiation messages potentially leading to less secure client authentication algorithms or deactivating keystroke timing attack countermeasures.

Affected Versions

openssh

Specific versions:

• 0.1.0
• 0.1.1
• 0.2.0
• 0.2.1
• 0.3.0
• 0.4.0
• 0.5.0
• 0.6.0
• 0.7.0
• 0.8.0
• 0.9.0
• 1.0.0
• 1.1.0
• 1.2.0
• 2.0.0
• 2.0.1
• 2.0.2
• 2.1.0
• 2.1.1
• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7
• 2.2.8
• 3.0.0
• 3.0.1
• 3.0.2
• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4

Recommendations

No specific recommendations provided.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-48795

Additional Information

Aliases: CVE-2023-48795

Published: December 27, 2023
Last Modified: December 27, 2023