CVE-2023-48795
pfSense: The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products
CVE-2023-48795: pfSense: The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
CVE-2023-48795 at a glance
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- Critical
- CVSS base score
- 5.9 (pfSense)
- Fixed releases
- pfSense: 9.6, 3.1.0-SNAPSHOT, 5.1.1, 0.80, 2.14.2, 0.17.0 and 14 more in the advisory
- VulniPulse record
- Published · Updated
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2023-48795; bulletin-wide values are not repeated here.
Is CVE-2023-48795 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2023-48795 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2023-48795?
Upgrade to a fixed release named by the vendor:
- pfSense: 9.6, 3.1.0-SNAPSHOT, 5.1.1, 0.80, 2.14.2, 0.17.0
Vendor advisory comparison
pfSense
1 advisory- Advisory severityMedium5.9
Medium [CVE-2023-48795] pfSense: The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products
CVE-2023-48795Source published Source updated
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in [email protected] and (if CBC is used) the [email protected] MAC algorithms. This also affects…
- Related products — impact not confirmed
- pfSense
- pfSense Plus
- pfSense CE
- Netgate
- Source-reported affected versions
- before 9.6
- before 3.1.0
- before 5.1.1
- before 0.80
8 more entries in the full advisory.
- Source-reported fixed versions
- 9.6
- 3.1.0-SNAPSHOT
- 5.1.1
- 0.80
16 more entries in the full advisory.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Veeam
1 advisory- Advisory severityCritical
Critical [CVE-2020-14040 +101] List of Security Fixes and Improvements in Veeam Kasten for Kubernetes
KB4825Source published
This bulletin covers 102 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
List of Security Fixes and Improvements in Veeam Kasten for Kubernetes KB ID: 4825 Product: Kasten K10 by Veeam | 3 | 5 | 5.5 | 6 | 6.5 Published: 2026-03-02 Last Modified: Purpose This article aims to provide our customers' security and compliance teams with detailed information on security improvements. - Veeam Kasten for Kubernetes — Release Notes - Also resolves 23 Medium and 2 Low severity CVEs in the same and other packages. - Upgraded to latest UBI base image to resolve multiple CVEs in base OS packages. - Updated the Go runtime to resolve additional upstream Go CVEs. - Updated the bundled Prometheus Helm chart to resolve security issues. - Upgraded the Prometheus base image to resolve GHSA-hrxh-6v49-42gf - GitHub Advisory - Upgraded Dex image dependencies to resolve multiple…
- Related products — impact not confirmed
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- 8.5.10
- 8.5.5
- 1.26.1
- 8.5.3
20 more entries in the full advisory.
- Mitigation guidance
- List of Security Fixes and Improvements in Veeam Kasten for Kubernetes KB ID: 4825 Product: Veeam Kasten for Kubernetes | 7 | 7.5 | 8 | 8.5 | 9 Kasten K10 by Veeam | 3 | 5 | 5.5 | 6 | 6.5 Published: 2026-03-02 Last Modified: 2026-10-19 Purpose This article describes all security-related fixes and improvements introduced in each release or update of Veeam Kasten for Kubernetes.
- It is recommended to upgrade Veeam Kasten and to refresh the token by manually logging out.
- Mitigation: Configure a bucket-level Default Object Lock retention so the object store stamps new objects at write time, or upgrade to Kasten 8.5.10.
- Veeam Kasten for Kubernetes 8.5.5 Upgrade to Go 1.26.1 to address CVE-2026-25679 and CVE-2026-27142 Updated the UBI base image to address CVE-2026-4111 Veeam Kasten for Kubernetes 8.5.3 Upgrade to Go 1.25.7 to address CVE-2025-61732.
4 more entries in the full advisory.
- Workarounds
- Veeam Kasten for Kubernetes 8.0.14 Improved logging security for specific block mode datamover upload Pod invocations.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.