p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de libssh · Page n° 2

Vulnérabilités publiées pour libssh au cours des 30 derniers jours : 0. Présentes dans le catalogue KEV : 0.

RSS ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 44

  1. CVE-2025-5987

    Élevée · CVSS 8.1EPSS 1,73%Correctif disponible

    Libssh: invalid return code for chacha20 poly1305 with openssl backend

    A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.

    libsshSystèmes d’exploitation
    • Mettez à jour vers 0.11.2-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2025-5351

    Moyenne · CVSS 6.5EPSS 0,61%Correctif disponible

    Libssh: double free vulnerability in libssh key export functions

    A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed.

    libsshSystèmes d’exploitation
    • Mettez à jour vers 0.11.2-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2025-5372

    Moyenne · CVSS 5EPSS 0,5%Correctif disponible

    Libssh: incorrect return code handling in ssh_kdf() in libssh

    A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.

    libsshSystèmes d’exploitation
    • Mettez à jour vers 0.11.2-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2025-5318

    Moyenne · CVSS 5.4EPSS 1,84%Correctif disponible

    Libssh: out-of-bounds read in sftp_handle()

    A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.

    libsshSystèmes d’exploitation
    • Mettez à jour vers 0.11.2-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2023-6004

    Moyenne · CVSS 4.8EPSS 0,45%Correctif disponible

    Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname

    A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.

    libsshSystèmes d’exploitation
    • Mettez à jour vers 0.10.6-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2023-6918

    Faible · CVSS 3.7EPSS 1,41%Correctif disponible

    Libssh: missing checks for return values for digests

    A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.

    libsshSystèmes d’exploitation
    • Mettez à jour vers 0.10.6-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2023-48795

    Moyenne · CVSS 5.9EPSS 93,55%Code d’exploitation publicCorrectif disponible

    CVE-2023-48795

    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with E

    libsshSystèmes d’exploitation
    • Mettez à jour vers 0.10.6-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. CVE-2023-2283

    Moyenne · CVSS 6.5EPSS 1,06%Correctif disponible

    CVE-2023-2283

    A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.

    libsshSystèmes d’exploitation
    • Mettez à jour vers 0.10.5-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2021-3634

    Moyenne · CVSS 6.5EPSS 4,68%Correctif disponible

    CVE-2021-3634

    A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other session_id. Initially, both of them are the same, but after key re-exchange, previous session_id is kept and used as an input to new secret_hash. Historically, both of these buffers had shared length variable, which worked as long as these buffers were same. But the key re-exchange operation can also change the key exchange method, which can be based on hash of different size, eventually creating "secret_hash" of different size than the session_id has

    libsshSystèmes d’exploitation
    • Mettez à jour vers 0.9.6-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  12. CVE-2020-1730

    Moyenne · CVSS 5.3EPSS 3,14%Correctif disponible

    CVE-2020-1730

    A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.

    libsshSystèmes d’exploitation
    • Mettez à jour vers 0.9.4-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2019-14889

    Élevée · CVSS 7.1EPSS 3,17%Correctif disponible

    CVE-2019-14889

    A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.

    libsshSystèmes d’exploitation
    • Mettez à jour vers 0.9.3-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  15. CVE-2016-0739

    Moyenne · CVSS 5.9EPSS 2,43%Correctif disponible

    CVE-2016-0739

    libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to 128 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."

    libsshSystèmes d’exploitation
    • Mettez à jour vers 0.6.3-4.3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2015-3146

    Élevée · CVSS 7.5EPSS 3,96%Correctif disponible

    CVE-2015-3146

    The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not properly validate state, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet.

    libsshSystèmes d’exploitation
    • Mettez à jour vers 0.6.3-4.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. CVE-2014-0017

    Non évaluéeEPSS 0,36%Correctif disponible

    CVE-2014-0017

    The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision.

    libsshSystèmes d’exploitation
    • Mettez à jour vers 0.5.4-3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →