Low: libssh security, bug fix, and enhancement update
Summary
RLSA-2022:2031: Low: libssh security, bug fix, and enhancement update. Affects libssh versions < 0:0.9.6-3.el8. Fixed in 0:0.9.6-3.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libssh is a library that implements the SSH protocol, enabling the development of client and server applications. It provides a secure means of communication over a network. The library has been upgraded to version 0.9.6 in Rocky Linux 8.6.
Vulnerability Detail
A possible heap-based buffer overflow vulnerability (CVE-2021-3634) has been identified in libssh when rekeying. This vulnerability could potentially be exploited by an attacker to execute arbitrary code or cause a denial of service. The CVSS score for this vulnerability is 3.5, indicating a low severity level.
How To Fix
Minimum fixed version
0:0.9.6-3.el8
This is the first release that contains the fix.
sudo dnf update libsshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, libssh has been updated to address a low-severity vulnerability related to a possible heap-based buffer overflow. It is recommended to update the libssh package to version 0.9.6-3.el8 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libssh →
FAQ
libssh is a library that implements the SSH protocol, allowing secure communication between client and server applications.
The vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial of service.
The CVSS score for this vulnerability is 3.5, indicating a low severity level.
To fix this vulnerability, update the libssh package to version 0.9.6-3.el8 or later.
You can find more information about this vulnerability in the CVE page listed in the References section.
References
Related vulnerabilities
Recent vulnerabilities recorded for libssh.
