Lucene search
UbuntuUSN-6589-1HistoryJan 18, 2024 - 12:00 a.m.
FileZilla vulnerability
2024-01-1800:00:00
ubuntu.com
16
filezilla
terrapin attack
ssh protocol
prefix truncation
remote attacker
security features
sensitive information
ubuntu
vulnerability
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
6.7 Medium
AI Score
Confidence
High
0.963 High
EPSS
Percentile
99.5%
Releases
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Packages
- filezilla - Full-featured graphical FTP/FTPS/SFTP client
Details
Fabian Baeumer, Marcus Brinkmann and Joerg Schwenk discovered that the SSH
protocol used in FileZilla is prone to a prefix truncation attack, known as
the “Terrapin attack”. A remote attacker could use this issue to downgrade or
disable some security features and obtain sensitive information.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Ubuntu | 23.10 | noarch | filezilla | < 3.65.0-3ubuntu0.1 | UNKNOWN |
| Ubuntu | 23.10 | noarch | filezilla-common | < 3.65.0-3ubuntu0.1 | UNKNOWN |
| Ubuntu | 23.10 | noarch | filezilla-dbgsym | < 3.65.0-3ubuntu0.1 | UNKNOWN |
| Ubuntu | 22.04 | noarch | filezilla | < 3.58.0-1ubuntu0.1 | UNKNOWN |
| Ubuntu | 22.04 | noarch | filezilla-common | < 3.58.0-1ubuntu0.1 | UNKNOWN |
| Ubuntu | 22.04 | noarch | filezilla-dbgsym | < 3.58.0-1ubuntu0.1 | UNKNOWN |
| Ubuntu | 20.04 | noarch | filezilla | < 3.46.3-1ubuntu0.1 | UNKNOWN |
| Ubuntu | 20.04 | noarch | filezilla-common | < 3.46.3-1ubuntu0.1 | UNKNOWN |
| Ubuntu | 20.04 | noarch | filezilla-dbgsym | < 3.46.3-1ubuntu0.1 | UNKNOWN |
References
Related
openvas
openvas
Mageia: Security Advisory (MGASA-2024-0002)
2024-01-09 00:00:00
SUSE: Security Advisory (SUSE-SU-2024:0006-1)
2024-01-03 00:00:00
Fedora: Security Advisory for python-asyncssh (FEDORA-2023-e77300e4b5)
2023-12-30 00:00:00
veracode
veracode
Prefix Truncation Attack (Terrapin Attack)
2023-12-19 09:12:16
Rogue Session Attack (Terrapin)
2023-12-19 06:46:15
fedora
fedora
[SECURITY] Fedora 39 Update: proftpd-1.3.8b-1.fc39
2023-12-30 01:23:29
[SECURITY] Fedora 39 Update: golang-x-crypto-0.18.0-1.fc39
2024-01-18 01:47:06
[SECURITY] Fedora 38 Update: prometheus-podman-exporter-1.7.0-1.fc38
2024-01-29 07:54:09
ibm
ibm
oraclelinux
oraclelinux
openssh security update
2024-02-13 00:00:00
openssh security update
2024-03-18 00:00:00
buildah security update
2024-03-07 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2024-2382
2024-03-26 11:47:18
osv
osv
phpseclib - security update
2024-01-25 00:00:00
python-asyncssh - security update
2024-02-01 00:00:00
php-phpseclib - security update
2024-01-12 00:00:00
paloalto
paloalto
Impact of Terrapin SSH Attack
2024-01-09 01:30:00
mageia
mageia
Updated filezilla packages fix a security vulnerability ("Terrapin attack")
2024-02-10 04:03:35
Updated libssh2 packages fix a security vulnerability (Terrapin Attack)
2024-01-08 13:12:44
Updated erlang packages fix a security vulnerability (Terrapin Attack)
2024-01-20 01:43:32
prion
prion
Design/Logic Flaw
2023-12-18 16:15:00
freebsd
freebsd
putty -- add protocol extension against 'Terrapin attack'
2023-10-16 00:00:00
jenkins -- Terrapin SSH vulnerability in Jenkins CLI client
2024-04-17 00:00:00
nessus
nessus
Fedora 38 : putty (2024-71c2c6526c)
2024-01-10 00:00:00
Fedora 39 : podman (2024-3bb23c77f3)
2024-01-08 00:00:00
Debian dsa-5600 : php-phpseclib - security update
2024-01-16 00:00:00
cbl_mariner
cbl_mariner
CVE-2023-48795 affecting package erlang for versions less than 25.2-2
2024-02-25 03:00:06
CVE-2023-48795 affecting package jsch for versions less than 0.1.55-2
2024-07-05 21:08:39
debian
debian
[SECURITY] [DSA 5599-1] phpseclib security update
2024-01-12 07:13:27
[SECURITY] [DSA 5600-1] php-phpseclib security update
2024-01-12 07:13:37
[SECURITY] [DLA 3718-1] php-phpseclib security update
2024-01-25 02:26:07
cvelist
cvelist
CVE-2023-48795
2023-12-18 00:00:00
redhat
redhat
(RHSA-2024:0628) Moderate: libssh security update
2024-01-31 08:17:03
(RHSA-2024:0499) Moderate: libssh security update
2024-01-25 15:19:29
(RHSA-2024:0625) Moderate: libssh security update
2024-01-31 08:08:23
ubuntu
ubuntu
libssh2 vulnerability
2024-01-15 00:00:00
LXD vulnerability
2024-04-22 00:00:00
Paramiko vulnerability
2024-01-25 00:00:00
atlassian
atlassian
CVE-2023-48795 vulnerability on SSH
2024-01-04 17:19:13
cloudfoundry
cloudfoundry
USN-6561-1: libssh vulnerability | Cloud Foundry
2024-04-04 00:00:00
redos
redos
ROS-20240408-15
2024-04-08 00:00:00
ROS-20240409-04
2024-04-09 00:00:00
alpinelinux
alpinelinux
CVE-2023-48795
2023-12-18 16:15:10
amazon
amazon
Medium: openssh
2023-12-18 09:20:00
almalinux
almalinux
Moderate: libssh security update
2024-01-31 00:00:00
ubuntucve
ubuntucve
CVE-2023-48795
2023-12-18 00:00:00
github
github
freebsd_advisory
freebsd_advisory
FreeBSD-SA-23:19.openssh
2023-12-19 00:00:00
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
6.7 Medium
AI Score
Confidence
High
0.963 High
EPSS
Percentile
99.5%
Related for USN-6589-1