-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing authentication state checks in the packet processing flow. The security fix in commit 16e6ebf adds a critical validation in _recv_packet() that rejects non-auth packets (types > MSG_USERAUTH_LAST) when auth_complete=False. The test case test_request_during_auth explicitly verifies this by attempting to send a global request during authentication. The vulnerable versions lacked this check, allowing packet processing to proceed before authentication completed.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| AsyncSSH | pip | < 1.12.1 | 1.12.1 |