Moderate: libssh security update
Summary
ALSA-2023:3839: Moderate: libssh security update. Affects libssh versions < 0.9.6-10.el8_8. Fixed in 0.9.6-10.el8_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libssh is a library that implements the SSH protocol, allowing the development of client and server applications. It provides functionality for secure communication and authentication over a network. The library is widely used in various software applications that require secure remote access or file transfer capabilities.
Vulnerability Detail
The libssh library is affected by two security vulnerabilities:
-
CVE-2023-1667: This vulnerability is a NULL pointer dereference issue that occurs during rekeying with algorithm guessing. An attacker could exploit this vulnerability to cause a denial of service (DoS) condition by sending specially crafted packets to the affected application.
-
CVE-2023-2283: This vulnerability allows an attacker to bypass authorization checks in the pki_verify_data_signature function. By exploiting this vulnerability, an attacker could gain unauthorized access to sensitive information or perform unauthorized actions on the affected system.
How To Fix
Minimum fixed version
0.9.6-10.el8_8
This is the first release that contains the fix.
sudo dnf update libsshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the recommended updates to mitigate the risk of exploitation.
Conclusion
The libssh library is affected by two security vulnerabilities that could lead to a denial of service condition or unauthorized access. It is crucial to update the libssh package to the latest version to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libssh →
FAQ
libssh is a library that implements the SSH protocol, providing secure communication and authentication capabilities for client and server applications.
CVE-2023-1667 can lead to a denial of service (DoS) condition in applications using the libssh library.
CVE-2023-2283 allows an attacker to bypass authorization checks and potentially gain unauthorized access to sensitive information or perform unauthorized actions.
To fix these vulnerabilities, update the libssh package to version 0.9.6-10.el8_8 or later.
No, there are no known workarounds for these vulnerabilities. Updating the libssh package is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for libssh.
