Terrapin Attack

[elvexys-md]

Hello,

Maybe my question is a bit simple, but is SSH.NET vulnerable to the Terrapin attack?
https://terrapin-attack.com/

CVE-2023-48795: General Protocol Flaw
CVE-2023-46445: Rogue Extension Negotiation Attack in AsyncSSH
CVE-2023-46446: Rogue Session Attack in AsyncSSH

Thanks,
Michel

[Rob-Hague]

See #1307 and #1285. In addition:

Version 2024.0.0 adds support for Encrypt-then-MAC algorithms but without a mitigation.
#1366 adds the strict key exchange mitigation. It will be included in the next version.

[elvexys-md]

Great, thanks for your prompt and complete reply!
I thought I'd looked carefully through the discussions...

[scott-xu]

Just want to be precise. Version 2024.0.0 adds support for Encrypt-then-MAC algorithms only when target .NET 6.0 onward.