Moderate: libssh security update
Summary
RLSA-2023:3839: Moderate: libssh security update. Affects libssh versions < 0:0.9.6-10.el8_8. Fixed in 0:0.9.6-10.el8_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libssh is a library that implements the SSH protocol, allowing the development of client and server applications. It provides functionality for secure communication and authentication between systems. The library is widely used in various software applications that require SSH functionality.
Vulnerability Detail
The libssh library is affected by two security vulnerabilities:
-
CVE-2023-1667: This vulnerability is a NULL pointer dereference issue that occurs during rekeying with algorithm guessing. An attacker could exploit this vulnerability to cause a denial-of-service condition or potentially execute arbitrary code.
-
CVE-2023-2283: This vulnerability is an authorization bypass in the pki_verify_data_signature function. An attacker with a specially crafted signature could bypass authentication checks and gain unauthorized access to the SSH server.
These vulnerabilities pose a moderate risk and could lead to unauthorized access, data compromise, or service disruption.
How To Fix
Minimum fixed version
0:0.9.6-10.el8_8
This is the first release that contains the fix.
sudo dnf update libsshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
libssh is a widely used library for implementing SSH functionality in various software applications. It has been identified that versions prior to 0.9.6-10.el8_8 are affected by two security vulnerabilities. To mitigate these vulnerabilities, it is crucial to update the libssh library to the recommended version or later. For further assistance or support in addressing these vulnerabilities, please contact DevNack.com.
See every vulnerability recorded for libssh →
FAQ
libssh is a library that implements the SSH protocol, providing secure communication and authentication capabilities for client and server applications.
The vulnerabilities could allow an attacker to cause a denial-of-service condition, execute arbitrary code, or bypass authentication checks to gain unauthorized access.
No, only versions prior to 0.9.6-10.el8_8 are affected. It is recommended to update to the latest version to mitigate the vulnerabilities.
No specific workaround has been provided. It is recommended to update to the patched version of libssh to address the vulnerabilities.
You can find more details about the vulnerabilities, including their impact and CVSS scores, on the respective CVE pages: CVE-2023-1667 and CVE-2023-2283.
Related vulnerabilities
Recent vulnerabilities recorded for libssh.
