CVE-2023-48795The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from…
Updated under an hour ago ()
Does this affect you?
It affects Siemens RUGGEDCOM APE1808 and 59 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.
- CVSS
- 5.9 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness (CWE)
- CWE-354
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- mitre
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Siemens RUGGEDCOM APE1808 siemens:ruggedcom_ape1808 (from the name) | all versions | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.5 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.5 | CISA ADP |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | before V1.1 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.5 | CISA ADP |
openbsd openssh openbsd:openssh | before 9.6 | NVD |
putty putty putty:putty | before 0.80 | NVD |
filezilla-project filezilla_client filezilla-project:filezilla_client | before 3.66.4 | NVD |
panic transmit_5 panic:transmit_5 | before 5.10.4 | NVD |
panic nova panic:nova | before 11.8 | NVD |
roumenpetrov pkixssh roumenpetrov:pkixssh | before 14.4 | NVD |
winscp winscp winscp:winscp | before 6.2.2 | NVD |
bitvise ssh_client bitvise:ssh_client | before 9.33 | NVD |
bitvise ssh_server bitvise:ssh_server | before 9.32 | NVD |
lancom-systems lcos lancom-systems:lcos | through 3.66.4 | NVD |
lancom-systems lcos_fx lancom-systems:lcos_fx | all versions | NVD |
lancom-systems lcos_lx lancom-systems:lcos_lx | all versions | NVD |
lancom-systems lcos_sx lancom-systems:lcos_sx | 4.20; 5.20 | NVD |
lancom-systems lanconfig lancom-systems:lanconfig | all versions | NVD |
vandyke securecrt vandyke:securecrt | before 9.4.3 | NVD |
libssh libssh libssh:libssh | before 0.10.6 | NVD |
net-ssh net-ssh net-ssh:net-ssh | 7.2.0 | NVD |
ssh2_project ssh2 ssh2_project:ssh2 | through 1.11.0 | NVD |
proftpd proftpd proftpd:proftpd | through 1.3.8b | NVD |
freebsd freebsd freebsd:freebsd | through 12.4 | NVD |
crates thrussh crates:thrussh | before 0.35.1 | NVD |
tera_term_project tera_term tera_term_project:tera_term | through 5.1 | NVD |
oryx-embedded cyclone_ssh oryx-embedded:cyclone_ssh | before 2.3.4 | NVD |
crushftp crushftp crushftp:crushftp | through 10.6.0; before 10.6.0 | NVD |
netsarang xshell_7 netsarang:xshell_7 | before build__0144 | NVD |
paramiko paramiko paramiko:paramiko | before 3.4.0 | NVD |
redhat openshift_container_platform redhat:openshift_container_platform | 4.0 | NVD |
redhat openstack_platform redhat:openstack_platform | 16.1; 16.2; 17.1 | NVD |
redhat ceph_storage redhat:ceph_storage | 6.0 | NVD |
redhat enterprise_linux redhat:enterprise_linux | 8.0; 9.0 | NVD |
redhat openshift_serverless redhat:openshift_serverless | all versions | NVD |
redhat openshift_gitops redhat:openshift_gitops | all versions | NVD |
redhat openshift_pipelines redhat:openshift_pipelines | all versions | NVD |
redhat openshift_developer_tools_and_services redhat:openshift_developer_tools_and_services | all versions | NVD |
redhat openshift_data_foundation redhat:openshift_data_foundation | 4.0 | NVD |
redhat openshift_api_for_data_protection redhat:openshift_api_for_data_protection | all versions | NVD |
redhat openshift_virtualization redhat:openshift_virtualization | 4 | NVD |
redhat storage redhat:storage | 3.0 | NVD |
redhat discovery redhat:discovery | all versions | NVD |
redhat openshift_dev_spaces redhat:openshift_dev_spaces | all versions | NVD |
redhat cert-manager_operator_for_red_hat_openshift redhat:cert-manager_operator_for_red_hat_openshift | all versions | NVD |
redhat keycloak redhat:keycloak | all versions | NVD |
redhat jboss_enterprise_application_platform redhat:jboss_enterprise_application_platform | 7.0 | NVD |
redhat single_sign-on redhat:single_sign-on | 7.0 | NVD |
redhat advanced_cluster_security redhat:advanced_cluster_security | 3.0; 4.0 | NVD |
golang crypto golang:crypto | before 0.17.0 | NVD |
russh_project russh russh_project:russh | before 0.40.2 | NVD |
sftpgo_project sftpgo sftpgo_project:sftpgo | before 2.5.6 | NVD |
erlang erlang/otp erlang:erlang/otp | before 22.3.4.27; from 23.0 before 23.3.4.20; from 24.0 before 24.3.4.15; from 25.0 before 25.3.2.8; from 26.0 before 26.2.1 | NVD |
matez jsch matez:jsch | before 0.2.15 | NVD |
libssh2 libssh2 libssh2:libssh2 | before 1.11.1 | NVD |
asyncssh_project asyncssh asyncssh_project:asyncssh | before 2.14.2 | NVD |
dropbear_ssh_project dropbear_ssh dropbear_ssh_project:dropbear_ssh | before 2022.83 | NVD |
jadaptive maverick_synergy_java_ssh_api jadaptive:maverick_synergy_java_ssh_api | before 3.1.0-snapshot | NVD |
ssh ssh ssh:ssh | before 4.9.1.5; from 4.10 before 4.11.1.7; from 4.12 before 4.13.2.4; from 4.14 before 4.15.3.1; from 5.0 before 5.1.1 | NVD |
References
- https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
- https://matt.ucc.asn.au/dropbear/CHANGES
- https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES
- https://www.netsarang.com/en/xshell-update-history/
- https://www.paramiko.org/changelog.html
- https://www.openssh.com/openbsd.html
- https://github.com/openssh/openssh-portable/commits/master
- https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ
- https://www.bitvise.com/ssh-server-version-history
- https://github.com/ronf/asyncssh/tags
- https://gitlab.com/libssh/libssh-mirror/-/tags
- https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed/
- https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42
- https://www.openssh.com/txt/release-9.6
- https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795/
- https://www.terrapin-attack.com
- https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25
- https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst
- https://thorntech.com/cve-2023-48795-and-sftp-gateway/
- https://github.com/warp-tech/russh/releases/tag/v0.40.2
- https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0patch
- https://www.openwall.com/lists/oss-security/2023/12/18/2
- https://twitter.com/TrueSkrillor/status/1736774389725565005
- https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d
- https://github.com/paramiko/paramiko/issues/2337
- http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.htmlthird-party-advisory, vdb-entry
- http://seclists.org/fulldisclosure/2024/Mar/21mailing-list, third-party-advisory
- http://www.openwall.com/lists/oss-security/2023/12/18/3mailing-list
- http://www.openwall.com/lists/oss-security/2023/12/19/5mailing-list
- http://www.openwall.com/lists/oss-security/2023/12/20/3mailing-list, mitigation
- http://www.openwall.com/lists/oss-security/2024/03/06/3mailing-list
- http://www.openwall.com/lists/oss-security/2024/04/17/8mailing-list
- https://access.redhat.com/security/cve/cve-2023-48795third-party-advisory
- https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/press/media-coverage
- https://bugs.gentoo.org/920280issue-tracking
- https://bugzilla.redhat.com/show_bug.cgi?id=2254210issue-tracking
- https://bugzilla.suse.com/show_bug.cgi?id=1217950issue-tracking
- https://crates.io/crates/thrussh/versionsrelease-notes
- https://filezilla-project.org/versions.phprelease-notes
- https://forum.netgate.com/topic/184941/terrapin-ssh-attackissue-tracking
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.