WaratekVRT Sign in

CVE-2023-48795

Affected software19 products, listed below
Severity5.9 Medium CVSS 3.1 2 scores
WeaknessCWE-354
Published18 Dec 2023
Updated15 Oct 2026

Description

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 2 citations · earliest 2025-02-05.
  • CISA Vulnrichment exploitation: poc CISA recorded that an exploit has been demonstrated. Automatable: no, technical impact: partial.
  • Indexed PoC 7 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2025-01-08.
  • EPSS 94% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.8% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2023-48795 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation picussecurity.com /hubfs/red-report-2025/Picus-RedReport-2025.pdf 2025-02-05
Reported exploitation 7048931.fs1.hubspotusercontent-na1.net /hubfs/7048931/Picus-RedReport2026.pdf 2026-02-10

5 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC A Python-based tool to check for vulnerabilities in OpenSSH installations on local or remote systems by scanning specific IPs. It checks if the OpenSSH version is affected by CVE-2023-48795 14 2025-01-08
GitHub PoC Scanner para identificação de servidores com softwares SSH possivelmente vulnerável às CVEs CVE-2024-6387 e CVE-2023-48795. 2 2026-05-21
GitHub PoC Mr-Whiskerss/SSH-Terrapin-Prefix-Truncation-Weakness-CVE-2023-48795-Checker 1 2026-06-08
GitHub PoC SSH Terrapin Attack Vulnerability Scanner (CVE-2023-48795) 1 2026-03-22
GitHub PoC Abstract state model of SSH sequence numbers and OpenSSH strict KEX for studying Terrapin (CVE-2023-48795). Not a reproduction. 2026-11-06
GitHub PoC Python tool to identify SSH servers potentially vulnerable to CVE-2023-48795 (Terrapin) by analyzing OpenSSH version banners via netcat. Useful for internal audits, penetration testing, and vulnerability assessments. 2025-05-23
Nuclei OpenSSH Terrapin Attack - Detection

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

5.9 MEDIUM v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 5.9 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N NVD Primary published
CVSS 3.1 5.9 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CISA-ADP Secondary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Security Patch Update September 2026 ↗ CSPU 2026-Q3 Oracle PeopleSoft / File Processing (libssh2) (8.61-8.63)
Oracle Critical Patch Update April 2026 ↗ CPU 2026-Q2 Oracle Fusion Middleware / Runtime Server (Apache Mina SSHD) (12.2.1.4.0)
Oracle Critical Patch Update April 2025 ↗ CPU 2025-Q2 Oracle Retail Applications / Xenvironment (Apache Mina SSHD) (19.0.6, 20.0.5, 21.0.4, 22.0.2, 23.0.2, 24.0.1)
Oracle Critical Patch Update January 2025 ↗ CPU 2025-Q1 Oracle Database Server / Database Migration Assistant for Unicode (Apache Mina SSHD) (19.1)
Oracle Financial Services Applications / Reports (Apache Mina SSHD) (8.1.2.5)
Oracle JD Edwards / Enterprise Infrastructure SEC (Apache Mina SSHD) (Prior to 9.2.9.0)
Oracle Critical Patch Update October 2024 ↗ CPU 2024-Q4 Oracle Blockchain Platform / Blockchain Cloud Service Console (OpenSSH) (21.1.2)
Oracle Communications / BEServer (Apache Mina SSHD) (24.1.0.0.0)
Oracle Communications / Platform (Apache Mina SSHD) (17.0.1)
Oracle Communications / Publications (Apache Mina SSHD) (9.1.1.9.0)
Oracle SQL Developer / Install (Apache Mina SSHD) (23.1.0)
Oracle Critical Patch Update July 2024 ↗ CPU 2024-Q3 Oracle Analytics / Analytics Visualization (Apache Mina SSHD) (Prior to 7.8.0)
Oracle Communications / Install/Upgrade (Apache Mina SSHD) (23.4.0-23.4.3)
Oracle Communications Applications / Installation (libssh) (2.0.0.0.0, 2.0.0.1.0)
Oracle Enterprise Manager / Agent Next Gen (Apache Mina SSHD) (13.5.0.0)
Oracle Enterprise Manager / Install (Apache Mina SSHD) (13.3.0.1)
Oracle Fusion Middleware / General (Apache Mina SSHD) (12.2.1.4.0)
Oracle Fusion Middleware / Runtime Java agent for ODI (Apache Mina SSHD) (12.2.1.4.0)
Oracle GoldenGate / General (Apache Mina SSHD) (19.1.0.0.0-19.23.0.0.240716, 21.3-21.14)
Oracle MySQL / Cluster: General (libssh) (8.0.37 and prior, 8.4.0 and prior)
Oracle MySQL / MySQL Workbench (libssh) (8.0.36 and prior)
Oracle NoSQL Database / Administration (Apache Mina SSHD) (Prior to 19.5.42, Prior to 20.3.40, Prior to 21.2.27, Prior to 22.3.46, Prior to 23.3.32)
Oracle PeopleSoft / Web Server (Apache Mina SSHD) (8.60, 8.61)
Oracle Critical Patch Update April 2024 ↗ CPU 2024-Q2 Oracle Autonomous Health Framework / CLI AND SDK (Paramiko) (Prior to 24.2)
Oracle Communications / General or Others (Apache Mina SSHD) (9.0.0-9.0.2)
Oracle Communications / Install/Upgrade (Apache Mina SSHD) (22.4.0, 23.1.0, 23.2.0)
Oracle Communications / Install/Upgrade (Apache Mina SSHD) (23.4.1)
Oracle Communications / Install/Upgrade (libssh) (23.4.1)
Oracle Communications / Mediation Engine (Apache Mina SSHD) (5.0, 5.1, 5.2)
Oracle Communications / Patches (Apache Mina SSHD) (14.0.0.0.0)
Oracle Communications / Patches (Apache Mina SSHD) (9.0.0.0)
Oracle Communications / Security (Apache Mina SSHD) (9.0.0-9.0.2)
Oracle Database Server / Grid Infrastructure (Apache Mina SSHD) (21.3-21.13)
Oracle Database Server / Oracle SQLcl (Apache Mina SSHD) (19.3-19.22, 21.3-21.13)
Oracle Enterprise Manager / Enterprise Manager Install (Apache Mina SSHD) (13.5.0.0)
Oracle Fusion Middleware / Adapters (Apache Mina SSHD) (12.2.1.4.0)
Oracle Fusion Middleware / NextGen Installer (Apache Mina SSHD) (12.2.1.4.0)
Oracle Fusion Middleware / Remote Diagnostic Agent (Apache Mina SSHD) (12.2.1.4.0, 14.1.1.0.0)
Oracle Fusion Middleware / Third Party (Apache Mina SSHD) (12.2.1.4.0, 14.1.1.0.0)
Oracle Global Lifecycle Management / Database extensions (Apache Mina SSHD) (Prior to 12.2.0.1.42)
Oracle Retail Applications / Internal Operations (Apache Mina SSHD) (19.0.0.9)
Oracle Support Tools / DA - Diagnostic Assistant (Apache Mina SSHD) (2.12.45)
Oracle Support Tools / RDA - Remote Diagnostic Agent (Apache Mina SSHD) (24.1.24.1.16)
Oracle Support Tools / STB - Services Tools Bundle (Apache Mina SSHD) (24.1.24.1.16)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Analytics Analytics Visualization (Apache Mina SSHD) Prior to 7.8.0
Oracle Autonomous Health Framework CLI AND SDK (Paramiko) Prior to 24.2
Oracle Blockchain Platform Blockchain Cloud Service Console (OpenSSH) 21.1.2 21.1.2
Oracle Communications BEServer (Apache Mina SSHD) 24.1.0.0.0 24.1.0.0.0
Oracle Communications General or Others (Apache Mina SSHD) 9.0.0-9.0.2
Oracle Communications Install/Upgrade (Apache Mina SSHD) 23.4.0-23.4.3 22.4.0 · 23.1.0 · 23.2.0 · 23.4.1
Oracle Communications Install/Upgrade (libssh) 23.4.1 23.4.1
Oracle Communications Mediation Engine (Apache Mina SSHD) 5.0, 5.1, 5.2 5.0 · 5.1 · 5.2
Oracle Communications Patches (Apache Mina SSHD) 9.0.0.0 9.0.0.0 · 14.0.0.0.0
Oracle Communications Platform (Apache Mina SSHD) 17.0.1 17.0.1
Oracle Communications Publications (Apache Mina SSHD) 9.1.1.9.0 9.1.1.9.0
Oracle Communications Security (Apache Mina SSHD) 9.0.0-9.0.2
Oracle Communications Applications Installation (libssh) 2.0.0.0.0, 2.0.0.1.0 2.0.0.0.0 · 2.0.0.1.0
Oracle Database Server Database Migration Assistant for Unicode (Apache Mina SSHD) 19.1 19.1
Oracle Database Server Grid Infrastructure (Apache Mina SSHD) 21.3-21.13
Oracle Database Server Oracle SQLcl (Apache Mina SSHD) 19.3-19.22, 21.3-21.13
Oracle Enterprise Manager Agent Next Gen (Apache Mina SSHD) 13.5.0.0 13.5.0.0
Oracle Enterprise Manager Enterprise Manager Install (Apache Mina SSHD) 13.5.0.0 13.5.0.0
Oracle Enterprise Manager Install (Apache Mina SSHD) 13.3.0.1 13.3.0.1
Oracle Financial Services Applications Reports (Apache Mina SSHD) 8.1.2.5 8.1.2.5
Oracle Fusion Middleware Adapters (Apache Mina SSHD) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware General (Apache Mina SSHD) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware NextGen Installer (Apache Mina SSHD) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Remote Diagnostic Agent (Apache Mina SSHD) 12.2.1.4.0, 14.1.1.0.0 12.2.1.4.0 · 14.1.1.0.0
Oracle Fusion Middleware Runtime Java agent for ODI (Apache Mina SSHD) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Runtime Server (Apache Mina SSHD) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Third Party (Apache Mina SSHD) 12.2.1.4.0, 14.1.1.0.0 12.2.1.4.0 · 14.1.1.0.0
Oracle Global Lifecycle Management Database extensions (Apache Mina SSHD) Prior to 12.2.0.1.42
Oracle GoldenGate General (Apache Mina SSHD) 19.1.0.0.0-19.23.0.0.240716, 21.3-21.14
Oracle JD Edwards Enterprise Infrastructure SEC (Apache Mina SSHD) Prior to 9.2.9.0
Oracle MySQL Cluster: General (libssh) 8.0.37 and prior, 8.4.0 and prior
Oracle MySQL MySQL Workbench (libssh) 8.0.36 and prior
Oracle NoSQL Database Administration (Apache Mina SSHD) Prior to 19.5.42, Prior to 20.3.40, Prior to 21.2.27, Prior to 22.3.46, Prior to 23.3.32
Oracle PeopleSoft File Processing (libssh2) 8.61-8.63
Oracle PeopleSoft Web Server (Apache Mina SSHD) 8.60, 8.61 8.60 · 8.61
Oracle Retail Applications Internal Operations (Apache Mina SSHD) 19.0.0.9 19.0.0.9
Oracle Retail Applications Xenvironment (Apache Mina SSHD) 19.0.6, 20.0.5, 21.0.4, 22.0.2, 23.0.2, 24.0.1 19.0.6 · 20.0.5 · 21.0.4 · 22.0.2 · 23.0.2 · 24.0.1
Oracle SQL Developer Install (Apache Mina SSHD) 23.1.0 23.1.0
Oracle Support Tools DA - Diagnostic Assistant (Apache Mina SSHD) 2.12.45 2.12.45
Oracle Support Tools RDA - Remote Diagnostic Agent (Apache Mina SSHD) 24.1.24.1.16 24.1.24.1.16
Oracle Support Tools STB - Services Tools Bundle (Apache Mina SSHD) 24.1.24.1.16 24.1.24.1.16

Products and versions

68 products, 83 version entries
SourceVendorProductSchemeAffected versions
nvd 9bis kitty generic ≤ 0.76.1.13
nvd apache sshd generic ≤ 2.11.0
nvd apache sshj generic ≤ 0.37.0
nvd apple macos generic ≥ 14.0 and ＜ 14.4
nvd asyncssh project asyncssh generic ＜ 2.14.2
nvd bitvise ssh client generic ＜ 9.33
nvd bitvise ssh server generic ＜ 9.32
nvd connectbot sshlib generic ＜ 2.2.22
nvd crates thrussh generic ＜ 0.35.1
nvd crushftp crushftp generic ≤ 10.6.0 · ＜ 10.6.0
nvd debian debian linux generic 10.0
nvd dropbear ssh project dropbear ssh generic ＜ 2022.83
nvd erlang erlang\/otp generic ＜ 22.3.4.27 · ≥ 23.0 and ＜ 23.3.4.20 · ≥ 24.0 and ＜ 24.3.4.15 · ≥ 25.0 and ＜ 25.3.2.8 · ≥ 26.0 and ＜ 26.2.1
nvd fedoraproject fedora generic 38 · 39
nvd filezilla-project filezilla client generic ＜ 3.66.4
nvd freebsd freebsd generic ≤ 12.4
nvd gentoo security generic any version
nvd golang crypto generic ＜ 0.17.0
nvd jadaptive maverick synergy java ssh api generic ＜ 3.1.0
nvd lancom-systems lanconfig generic any version
nvd lancom-systems lcos generic ≤ 3.66.4
nvd lancom-systems lcos fx generic any version
nvd lancom-systems lcos lx generic any version
nvd lancom-systems lcos sx generic 4.20 · 5.20
nvd libssh libssh generic ＜ 0.10.6
nvd libssh2 libssh2 generic ＜ 1.11.1
nvd matez jsch generic ＜ 0.2.15
nvd net-ssh net-ssh generic 7.2.0
nvd netgate pfsense ce generic ≤ 2.7.2
nvd netgate pfsense plus generic ≤ 23.9.1
nvd netsarang xshell 7 generic ＜ 144
nvd openbsd openssh generic ＜ 9.6
nvd oryx-embedded cyclone ssh generic ＜ 2.3.4
nvd panic nova generic ＜ 11.8
nvd panic transmit 5 generic ＜ 5.10.4
nvd paramiko paramiko generic ＜ 3.4.0
nvd proftpd proftpd generic ≤ 1.3.8
nvd putty putty generic ＜ 0.80
nvd redhat advanced cluster security generic 3.0 · 4.0
nvd redhat ceph storage generic 6.0
nvd redhat cert-manager operator for red hat openshift generic any version
nvd redhat discovery generic any version
nvd redhat enterprise linux generic 8.0 · 9.0
nvd redhat jboss enterprise application platform generic 7.0
nvd redhat keycloak generic any version
nvd redhat openshift api for data protection generic any version
nvd redhat openshift container platform generic 4.0
nvd redhat openshift data foundation generic 4.0
nvd redhat openshift dev spaces generic any version
nvd redhat openshift developer tools and services generic any version
nvd redhat openshift gitops generic any version
nvd redhat openshift pipelines generic any version
nvd redhat openshift serverless generic any version
nvd redhat openshift virtualization generic 4
nvd redhat openstack platform generic 16.1 · 16.2 · 17.1
nvd redhat single sign-on generic 7.0
nvd redhat storage generic 3.0
nvd roumenpetrov pkixssh generic ＜ 14.4
nvd russh project russh generic ＜ 0.40.2
nvd sftpgo project sftpgo generic ＜ 2.5.6
nvd ssh ssh generic ＜ 4.9.1.5 · ≥ 4.10 and ＜ 4.11.1.7 · ≥ 4.12 and ＜ 4.13.2.4 · ≥ 4.14 and ＜ 4.15.3.1 · ≥ 5.0 and ＜ 5.1.1
nvd ssh2 project ssh2 generic ≤ 1.11.0
nvd tera term project tera term generic ≤ 5.1
nvd thorntech sftp gateway firmware generic ＜ 3.4.6
nvd tinyssh tinyssh generic ≤ 99999
nvd trilead ssh2 generic 6401
nvd vandyke securecrt generic ＜ 9.4.3
nvd winscp winscp generic ＜ 6.2.2

References

URLTags
http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2024/Mar/21 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/12/18/3 Mailing List
http://www.openwall.com/lists/oss-security/2023/12/19/5 Mailing List
http://www.openwall.com/lists/oss-security/2023/12/20/3 Mailing List, Mitigation
http://www.openwall.com/lists/oss-security/2024/03/06/3 Mailing List
http://www.openwall.com/lists/oss-security/2024/04/17/8 Mailing List
https://access.redhat.com/security/cve/cve-2023-48795 Third Party Advisory
https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/ Press/Media Coverage
https://bugs.gentoo.org/920280 Issue Tracking

Timeline
Published2023-12-18By the CVE Program.
VulnCheck KEV: earliest evidence2025-02-05Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
VulnCheck KEV: latest evidence2026-02-10Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-10-15NVD's own last-modified date for this record.