"Terrapin" MitM attack / CVE-2023-48795

[bitprophet]

This is just a tracking ticket to note that we are aware of the issue described here: https://terrapin-attack.com/ - and have been working with the researchers to release a new Paramiko version that mitigates the described attack pattern.

We expect to put out Paramiko 3.4 within the next day or so. The work in progress is here: https://github.com/paramiko/paramiko/tree/cve-2023-48795

[bitprophet]

CI is green now that I fixed some speling and inserted the final OpenSSH version number in our changelog. Waiting on a final thumbs up from the researchers re: additional fixes I put in yesterday, and will then plop this out on PyPI.

[bitprophet]

3.4 is on PyPI! https://www.paramiko.org/changelog.html#3.4.0

[anarcat]

@bitprophet could you clarify exactly what is the patch here? 96db1e2 and 33508c9?

i believe debian will need to backport the fixes to 2.7.2 and 2.4.2, your input on that would be tremendously useful...

[carnil]

Not upstream, but there is above mentioned a branch where the fixes were developed, so all what is between/covered by 2566d2d...3e4bdf9 is needed for the fixes?

[bitprophet]

Yup, @carnil's got it, that diff notation appears to match to the branch linked in the OP.

(I'm not sure why GH doesn't make it easier to examine branches post-merge. When I use tools like git log or lazygit I can see eg where the CVE branch branches off of the 3.3 branch, for example, which would have been == main at time of development.)

[bitprophet]

@anarcat ☝🏻 🙏🏻

[coldtobi]

Hi @bitprophet ,

I'm currently trying to fix paramiko for Debian buster (LTS). The version of paramiko in Debian buster is 2.4.2 - and I'd like to socialite your expertise to help me if my thoughts are correct.

While backpacking the patches, I realized that 2.4.2. might not be vulnerable to terrapin at all, as it seems not to support certain features required to exploit the vulnerability:
If I understood terrapin correctly it requires ChaCha20-Poly1305 or CBC-EtM support, and I think 2.4.2 does not have those. (I also think that 2.4.2 does not support EXT_INFO, but not sure on that.)

When using the terrapin Vulnerability Scanner , the tool seems to support the idea that this version is not vulnerable: (this is without the backported patches)

tobi@debian10-lts:~/build$ ./Terrapin_Scanner_Linux_amd64 -connect localhost:2200
================================================================================
==================================== Report ====================================
================================================================================

Remote Banner: SSH-2.0-paramiko_2.4.2

ChaCha20-Poly1305 support:   false
CBC-EtM support:             false

Strict key exchange support: false

The scanned peer supports Terrapin mitigations and can establish
connections that are NOT VULNERABLE to Terrapin. Glad to see this.
For strict key exchange to take effect, both peers must support it.

Note: This tool is provided as is, with no warranty whatsoever. It determines
      the vulnerability of a peer by checking the supported algorithms and
      support for strict key exchange. It may falsely claim a peer to be
      vulnerable if the vendor supports countermeasures other than strict key
      exchange.

Please correct any flaws in my thinking ;-)

Thanks a lot,
tobi

[bitprophet]

Hi @coldtobi,

It looks like the scanner is accurate; I just looked it up and we only added ETM MAC modes in Paramiko 2.5. (and ChaCha20 is still not implemented, fwiw).

And even Paramiko 2.5-2.8 are likely not super vulnerable, as EXT_INFO was only implemented in 2.9, and my understanding is that one of the main practical attacks with Terrapin is to force one end of the connection to disregard EXT_INFO.