Low: libssh security update
Summary
RLSA-2021:4387: Low: libssh security update. Affects libssh versions < 0:0.9.4-3.el8. Fixed in 0:0.9.4-3.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libssh is a library that implements the SSH protocol, allowing the development of client and server applications. It is widely used for secure remote administration and file transfer between systems.
Vulnerability Detail
The vulnerability identified as CVE-2020-16135 affects libssh versions prior to 0.9.4-3.el8 in Rocky Linux 8.5. It is a NULL pointer dereference issue in the sftpserver.c file, which occurs when the ssh_buffer_new function returns NULL. This vulnerability could be exploited by an attacker to cause a denial-of-service condition, potentially leading to service disruption or system instability.
How To Fix
Minimum fixed version
0:0.9.4-3.el8
This is the first release that contains the fix.
sudo dnf update libsshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The libssh vulnerability (CVE-2020-16135) can be mitigated by updating the libssh package to version 0.9.4-3.el8 or later. It is important to promptly apply the necessary updates to ensure the security and stability of your system. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for libssh →
FAQ
libssh is a library that implements the SSH protocol, enabling secure communication and remote administration between systems.
The vulnerability can be exploited to cause a denial-of-service condition, potentially leading to service disruption or system instability.
Versions of libssh prior to 0.9.4-3.el8 in Rocky Linux 8.5 are affected.
Yes, updating the libssh package to version 0.9.4-3.el8 or later will address this vulnerability.
You can refer to the CVE page for CVE-2020-16135 for more details on this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for libssh.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
