Moderate: libssh security update
Summary
ALSA-2023:6643: Moderate: libssh security update. Affects libssh versions < 0.10.4-11.el9. Fixed in 0.10.4-11.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libssh is a library that implements the SSH protocol, allowing the development of client and server applications. It provides functionality for secure communication and authentication over a network. The library is widely used in various software applications.
Vulnerability Detail
The libssh library is affected by two security vulnerabilities:
-
CVE-2023-1667: This vulnerability is a NULL pointer dereference issue that occurs during rekeying with algorithm guessing. An attacker could exploit this vulnerability to cause a denial of service (DoS) condition by sending specially crafted SSH packets.
-
CVE-2023-2283: This vulnerability allows an attacker to bypass authorization checks in the pki_verify_data_signature function. By exploiting this vulnerability, an attacker could gain unauthorized access to the SSH server.
These vulnerabilities pose a moderate risk and could lead to service disruption or unauthorized access to systems.
How To Fix
Minimum fixed version
0.10.4-11.el9
This is the first release that contains the fix.
sudo dnf update libsshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
libssh is affected by two moderate security vulnerabilities that could result in service disruption or unauthorized access. Users are advised to update the libssh package to version 0.10.4-11.el9 or later to mitigate these vulnerabilities. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libssh →
FAQ
libssh is a library that implements the SSH protocol, enabling secure communication and authentication over a network.
CVE-2023-1667 can lead to a denial of service (DoS) condition by exploiting a NULL pointer dereference issue during rekeying with algorithm guessing.
CVE-2023-2283 allows an attacker to bypass authorization checks, potentially leading to unauthorized access to the SSH server.
To fix these vulnerabilities, update the libssh package to version 0.10.4-11.el9 or later.
No specific workaround has been provided. It is recommended to update the libssh package to address the vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for libssh.
