CVE-2023-48795, known as the "Terrapin attack," is a protocol-level weakness in the SSH transport protocol itself, publicly disclosed on 18 December 2023 and affecting essentially every SSH implementation in widespread use, including OpenSSH, PuTTY, libssh, and others, when configured to use either the ChaCha20-Poly1305 cipher or a CBC-mode cipher combined with Encrypt-then-MAC.

CERTVU is issuing this advisory now, nearly three years after original disclosure, because CVE-2023-48795 continues to appear in the Shadowserver Foundation's "Accessible SSH" internet-scanning report - a recurring feed CERTVU monitors that identifies internet-reachable SSH servers still configured with vulnerable cipher modes.

The following version(s) are affected:

Any SSH server or client (including OpenSSH prior to 9.6, PuTTY, libssh, and other implementations) configured to allow the "This email address is being protected from spambots. You need JavaScript enabled to view it." cipher, or a CBC-mode cipher combined with "This email address is being protected from spambots. You need JavaScript enabled to view it." MAC negotiation – (Affected)
OpenSSH 9.6 and later, and other implementations supporting the "strict key exchange" countermeasure (published December 2023) – (Not affected, patched, when strict key exchange is negotiated by both endpoints)

Typical attack flow:

1. Establish a man-in-the-middle position on the network path — An attacker with an active man-in-the-middle position between an SSH client and server manipulates packet sequence numbers during the connection handshake, before encryption keys are fully established.
2. Silently truncate messages at the start of the secure channel — By injecting unauthenticated "ignore" messages and adjusting sequence numbers, the attacker removes an attacker-chosen number of consecutive messages from the very beginning of the secure channel without causing a MAC failure - potentially stripping security-relevant extension negotiation that neither endpoint will detect as missing.

Attack vectors:

• A network-based attack requiring the attacker to already hold an active man-in-the-middle position (CVSS AC:H) - this is not a fully remote, no-prerequisite attack, unlike most advisories CERTVU issues.
• No user interaction or privileges are required once a man-in-the-middle position is established.

Successful exploitation may allow attackers to:

• Silently remove messages from the start of an SSH secure channel, without either endpoint detecting the tampering.
• Downgrade or strip security-relevant protocol extensions and certain authentication mechanisms negotiated at connection start, weakening the effective security of an otherwise-encrypted SSH session.

CERTVU recommends the following:

1. Upgrade to SSH Software Supporting Strict Key Exchange

   Upgrade to OpenSSH 9.6 or later (or the equivalent fixed version of your specific SSH client/server software), noting that the fix is only effective when both endpoints of a connection support strict key exchange.

2. Disable Vulnerable Cipher Modes Where an Upgrade Isn't Yet Possible

   Disable vulnerable cipher modes where an immediate upgrade is not possible.

3. Check Exposure Against Shadowserver's Accessible SSH Report

   Check your own exposure against Shadowserver's Accessible SSH report.

4. Review SSH Configuration as Part of Routine Hardening

   Review SSH server configuration as part of routine hardening, not only at initial setup.

Report any suspected compromise involving SSH access to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.