GHSA-hfmc-7525-mj55: 
Python vulnerability analysis and mitigation

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, is vulnerable to a prefix truncation attack known as the Terrapin Attack (CVE-2023-48795). This vulnerability allows remote attackers to bypass integrity checks by omitting packets from the extension negotiation message, potentially resulting in security feature downgrades or disabling. The vulnerability affects multiple SSH implementations including AsyncSSH before 2.14.2, Dropbear through 2022.83, PuTTY before 0.80, libssh before 0.10.6, and many others (GitHub Advisory).

The vulnerability occurs in the SSH Binary Packet Protocol (BPP) due to mishandling of the handshake phase and sequence numbers. The attack specifically targets the ChaCha20-Poly1305 cipher (chacha20-poly1305@openssh.com) and Encrypt-then-MAC (*-etm@openssh.com) MAC algorithms. The attack works by injecting arbitrary SSHMSGIGNORE messages during initial key exchange and subsequently removing the same number of messages after key exchange completion. This is possible due to missing authentication of excess SSHMSGIGNORE messages and improper sequence number validation. The CVSS score is 5.9 (Medium), with attack vector: Network, attack complexity: High, and no privileges or user interaction required (GitHub Advisory).

The attack enables downgrading of connection security features through extension negotiation manipulation. For ChaCha20-Poly1305, the attack is guaranteed to work on every connection as this cipher only maintains the message's sequence number. For Encrypt-Then-MAC, practical exploitation requires a CBC cipher, though theoretical integrity is broken for all ciphers in this mode. The vulnerability primarily affects the integrity of the SSH connection, allowing attackers to potentially disable security features or exploit implementation flaws in a man-in-the-middle scenario (GitHub Advisory).

To mitigate this vulnerability, OpenSSH introduced a 'strict kex' mechanism that alters the SSH handshake to prevent unauthenticated message injection and sequence number manipulation. This countermeasure requires both client and server support to be effective. As a temporary solution, users can disable the affected algorithms (ChaCha20-Poly1305 and *-etm@openssh.com) and use unaffected alternatives like AES-GCM until patches are available (GitHub Advisory).