Source: python-asyncssh Version: 2.24.0-2 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for python-asyncssh. CVE-2026-62949[0]: | AsyncSSH is a Python package which provides an asynchronous client | and server implementation of the SSHv2 protocol on top of the Python | asyncio framework. Prior to 2.24.0, _process_channel_open and | _process_channel_open_confirmation in asyncssh/connection.py accept | a peer-supplied send_pktsize value of zero. When channel data | reaches SSHChannel._flush_send_buf in asyncssh/channel.py, the zero | value causes each loop iteration to slice and remove zero bytes | without reducing the send window, leaving the synchronous loop | permanently true with no await point. A malicious SSH server can | trigger the client path through SSH_MSG_CHANNEL_OPEN_CONFIRMATION | before the first channel write, while an authenticated client can | trigger the server path through SSH_MSG_CHANNEL_OPEN and freeze | every current and future connection handled by the process. This | vulnerability is fixed in 2.24.0. Note while th base of the fix [2] is in 2.24.0 indeend, there is a required followup [3]. Thus we are for security-tracker this CVE not yet considering as fixed with 2.24.0-1 but rather only when the followup commit is applied as we... If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-62949 https://www.cve.org/CVERecord?id=CVE-2026-62949 [1] https://github.com/ronf/asyncssh/security/advisories/GHSA-rw4j-r22c-9gc3 [2] https://github.com/ronf/asyncssh/commit/9c354270c009285525e126721e8ed5fbed1f8a67 [3] https://github.com/ronf/asyncssh/commit/756cbae5350789ce9735f15f704bae9b5a3608b8 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
