Moderate: libssh security, bug fix, and enhancement update
Summary
RLSA-2020:4545: Moderate: libssh security, bug fix, and enhancement update. Affects libssh versions < 0:0.9.4-2.el8. Fixed in 0:0.9.4-2.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libssh is a library that implements the SSH protocol, allowing the development of client and server applications. It provides secure communication and authentication capabilities for remote access and file transfer. The library is widely used in various software applications and systems.
Vulnerability Detail
The libssh library has been found to have two security vulnerabilities:
-
CVE-2020-1730: This vulnerability allows an attacker to cause a denial of service by exploiting a flaw in the handling of AES-CTR or DES ciphers.
-
CVE-2019-14889: This vulnerability arises from an unsanitized location in the scp command, which could lead to unintended command execution.
These vulnerabilities can potentially be exploited by malicious actors to disrupt services, execute arbitrary commands, or gain unauthorized access to systems.
How To Fix
Minimum fixed version
0:0.9.4-2.el8
This is the first release that contains the fix.
sudo dnf update libsshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is advised to apply the recommended fix by updating the libssh package to the latest version.
Conclusion
The libssh library has been updated to address the identified security vulnerabilities. It is recommended to update the libssh package to the latest version to ensure the security and integrity of systems using this library. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libssh →
FAQ
libssh is a library that implements the SSH protocol, providing secure communication and authentication capabilities for remote access and file transfer.
CVE-2020-1730 can be exploited to cause a denial of service by exploiting a flaw in the handling of AES-CTR or DES ciphers.
CVE-2019-14889 can lead to unintended command execution by exploiting an unsanitized location in the scp command.
To fix these vulnerabilities, update the libssh package to version 0.9.4-2.el8 or later.
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
References
Related vulnerabilities
Recent vulnerabilities recorded for libssh.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
