Skip to content
OpenAdvisories
Critical USN-4854-1 1 CVE

python-asyncssh vulnerability

Published Mar 15, 2021 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Matthijs Kooijman discovered that AsyncSSH server did not properly handle
authentication under certain conditions. An attacker with a specially
crafted client could use this vulnerability to skip authentication of SSH
sessions.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS python-asyncssh 1.11.1-1ubuntu0.1~esm1

Vulnerabilities 1

  • Critical 9.8
    CVE-2018-7749

    AsyncSSH SSH Server Authentication Bypass

    The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.

    python-asyncssh python-asyncssh asyncssh Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2018-7749