Critical NULL Pointer Dereference in libssh Package
Summary
ALPINE-CVE-2020-16135: libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL. Affects libssh versions < 0.8.9-r1. Fixed in 0.8.9-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libssh is a widely used C library that provides an implementation of the SSH (Secure Shell) protocol. It is designed to facilitate secure communication between systems over an unsecured network. The library is utilized in various applications and services that require secure data transmission. However, it has been identified to have vulnerabilities that can lead to potential exploitation, particularly a NULL pointer dereference issue in version 0.9.4.
Vulnerability Detail
The vulnerability identified as ALPINE-CVE-2020-16135 is a NULL pointer dereference in the libssh library, specifically in the tftpserver.c file. This issue arises when the function ssh_buffer_new returns NULL, leading to a crash or unexpected behavior in applications utilizing this library. The ramifications of this vulnerability can include denial of service attacks, where the application becomes unresponsive, potentially affecting the availability of services relying on libssh. The CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
How To Fix
Minimum fixed version
0.8.9-r1
This is the first release that contains the fix.
sudo apk add --upgrade libsshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected functionalities of the libssh library until an update can be applied. This may involve disabling certain features that rely on the tftpserver component, thereby mitigating the risk of exploitation.
Conclusion
The NULL pointer dereference vulnerability in the libssh package poses a moderate risk to applications relying on this library. It is crucial for users to update to the patched versions to ensure the security and stability of their applications. Utilizing tools like Vulert can further enhance vulnerability management.
See every vulnerability recorded for libssh →
FAQ
A NULL pointer dereference occurs when a program attempts to access memory at a location that has not been initialized, leading to crashes or unpredictable behavior.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary impact is denial of service, where applications using the vulnerable version of libssh may crash or become unresponsive.
Yes, patched versions of the libssh package are available for Alpine Linux. Users should update to the specified versions to mitigate the vulnerability.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file. It helps developers stay informed about potential security risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for libssh.
