CVE-2023-48795

Deeper analysis

CVE-2023-48795 is a protocol-level flaw in the SSH Binary Packet Protocol (BPP) handshake that affects OpenSSH before version 9.6 and numerous other implementations, including PuTTY before 0.80, Dropbear through 2022.83, libssh before 0.10.6, Paramiko before 3.4.0, AsyncSSH before 2.14.2, and many additional SSH libraries and products. The vulnerability, known as the Terrapin attack, stems from improper handling of sequence numbers and extension negotiation messages, allowing an attacker to omit packets from the handshake and thereby disable or downgrade integrity protections when ChaCha20-Poly1305 or CBC-with-Encrypt-then-MAC modes are in use.

A remote attacker positioned on the network path between client and server can exploit the flaw during the initial key exchange to strip selected packets without detection, resulting in a connection that has lost certain security properties while still appearing valid to both endpoints. The attack requires no authentication and succeeds against connections that negotiate the affected algorithms, though it is rated medium severity (CVSS 5.9) because of the high attack complexity involved.

Public advisories and coordinated disclosures referenced in the provided URLs describe vendor-specific patches that update the listed products to versions that correctly enforce sequence numbers and resist prefix truncation; operators are advised to apply those updates and, where feasible, prefer algorithms less susceptible to the prefix truncation technique.

EPSS for this CVE rose sharply from a low baseline to a peak of 0.9548 on 2025-01-22 before receding to the current value of 0.5300, indicating that exploitation interest increased substantially after public disclosure.