CVE-2018-7749 (published 2018-03-12T19:29Z)

The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/ronf/asyncssh
commit_details: repo_url: https://github.com/ronf/asyncssh
author: Ron Frederick
author_date: 2018-03-10 10:09:39-08:00
msg: Bump version number up to 1.12.1 and update change log and copyright
repository: repo_url: https://github.com/ronf/asyncssh
repo_name: ronf/asyncssh
description: AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework.
repo_language: Python
owner: ronf
file_changes: filename: README.rst
change_type: ModificationType.MODIFY
diff: @@ -77,7 +77,7 @@ License
 
 This package is released under the following terms:
 
-  Copyright (c) 2013-2017 by Ron Frederick <ronf@timeheart.net>.
+  Copyright (c) 2013-2018 by Ron Frederick <ronf@timeheart.net>.
   All rights reserved.
 
   This program and the accompanying materials are made available under

programming_language: Markdown
filename: version.py
change_type: ModificationType.MODIFY
diff: @@ -18,4 +18,4 @@ __author_email__ = 'ronf@timeheart.net'
 
 __url__ = 'http://asyncssh.timeheart.net'
 
-__version__ = '1.12.0'
+__version__ = '1.12.1'

programming_language: Python
filename: changes.rst
change_type: ModificationType.MODIFY
diff: @@ -3,6 +3,41 @@
 Change Log
 ==========
 
+Release 1.12.1 (10 Mar 2018)
+----------------------------
+
+* Implemented a fix for CVE-2018-7749, where a modified SSH client could
+  request that an AsyncSSH server perform operations before authentication
+  had completed. Thanks go to Matthijs Kooijman for discovering and
+  reporting this issue and helping to review the fix.
+
+* Added a non-blocking collect_output() method to SSHClientProcess to
+  allow applications to retrieve data received on an output stream
+  without blocking. This call can be called multiple times and freely
+  intermixed with regular read calls with a guarantee that output will
+  always be returned in order and without duplication.
+
+* Updated debug logging implementation to make it more maintainable, and
+  to fix an issue where unprocessed packets were not logged in some cases.
+
+* Extended the support below for non-ASCII characters in comments to apply
+  to X.509 certificates, allowing an optional encoding to be passed in to
+  get_comment() and set_comment() and a get_comment_bytes() function to
+  get the raw comment bytes without performing Unicode decoding.
+
+* Fixed an issue where a UnicodeDecodeError could be reported in some
+  cases instead of a KeyEncryptionError when a private key was imported
+  using the wrong passphrase.
+
+* Fixed the reporting of the MAC algorithm selected during key exchange to
+  properly report the cipher name for GCM and Chacha ciphers that don't
+  use a separate MAC algorithm. The correct value was being returned in
+  queries after the key exchange was complete, but the logging was being
+  done before this adjustment was made.
+
+* Fixed the documentation of connection_made() in SSHSession subclasses
+  to properly reflect the type of SSHChannel objects passed to them.
+
 Release 1.12.0 (5 Feb 2018)
 ---------------------------
 

programming_language: Markdown