Low: libssh security update
Summary
ALSA-2024:3233: Low: libssh security update. Affects libssh versions < 0.9.6-14.el8. Fixed in 0.9.6-14.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libssh is a library that implements the SSH protocol, allowing the development of client and server applications. It provides a secure means of communication and data transfer over a network. The library is widely used in various software applications and systems.
Vulnerability Detail
The libssh library has two security vulnerabilities:
-
ProxyCommand/ProxyJump features allow the injection of malicious code through the hostname. This vulnerability is identified as CVE-2023-6004. An attacker can exploit this vulnerability to execute arbitrary code or perform unauthorized actions on the target system.
-
The library lacks proper checks for return values for digests, which can lead to security issues. This vulnerability is identified as CVE-2023-6918. Attackers can potentially exploit this vulnerability to manipulate data integrity and compromise the security of the SSH communication.
These vulnerabilities pose a risk to systems that utilize the libssh library for SSH communication.
How To Fix
Minimum fixed version
0.9.6-14.el8
This is the first release that contains the fix.
sudo dnf update libsshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the recommended update to mitigate the risks associated with the vulnerabilities.
Conclusion
libssh has been found to have two security vulnerabilities that can be exploited to execute arbitrary code, perform unauthorized actions, and compromise SSH communication. It is highly recommended to update the libssh package to version 0.9.6-14.el8 or later to address these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libssh →
FAQ
libssh is a library that implements the SSH protocol, enabling the development of secure client and server applications.
The security vulnerabilities in libssh include the ability to inject malicious code through the hostname in ProxyCommand/ProxyJump features (CVE-2023-6004) and the lack of proper checks for return values for digests (CVE-2023-6918).
These vulnerabilities can allow attackers to execute arbitrary code, perform unauthorized actions, manipulate data integrity, and compromise the security of SSH communication.
To fix these vulnerabilities, update the libssh package to version 0.9.6-14.el8 or later. This update includes patches that address the identified security issues.
No, there are no known workarounds for these vulnerabilities. It is crucial to apply the recommended update to mitigate the risks.
Related vulnerabilities
Recent vulnerabilities recorded for libssh.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
