p PatchFirst

CVE-2023-6918

CVE-2023-6918 · Libssh: missing checks for return values for digests

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.

CVSS 3.7 · Low · EPSS 1.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • red hat enterprise linux 8

    Versions
    • ≥ 0:0.9.6-14.el8: Not affected (rpm)

    No fix published

  • red hat enterprise linux 9

    Versions
    • ≥ 0:0.10.4-13.el9: Not affected (rpm)

    No fix published

  • red hat enterprise linux 6

    No fix published

  • red hat enterprise linux 7

    No fix published

  • libssh Debian:12

    Versions
    • 0.10.5-2
    • 0.10.5-3
    • 0.10.5-3+hurd.1
    Affected ranges
    • ECOSYSTEM: < 0.10.6-0+deb12u1

    Update to 0.10.6-0+deb12u1

  • libssh Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.10.6-1

    Update to 0.10.6-1

  • libssh Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.10.6-1

    Update to 0.10.6-1

  • libssh Ubuntu:Pro:16.04:LTS

    Versions
    • 0.6.3-3ubuntu3
    • 0.6.3-4.1
    • 0.6.3-4.2
    • 0.6.3-4.2ubuntu1
    • 0.6.3-4.3
    • 0.6.3-4.3ubuntu0.1
    • 0.6.3-4.3ubuntu0.2
    • 0.6.3-4.3ubuntu0.5
    • 0.6.3-4.3ubuntu0.6
    Affected ranges
    • ECOSYSTEM: < 0.6.3-4.3ubuntu0.6+esm1

    Update to 0.6.3-4.3ubuntu0.6+esm1

  • libssh Ubuntu:Pro:18.04:LTS

    Versions
    • 0.7.5-1
    • 0.8.0~20170825.94fa1e38-1
    • 0.8.0~20170825.94fa1e38-1build1
    • 0.8.0~20170825.94fa1e38-1ubuntu0.1
    • 0.8.0~20170825.94fa1e38-1ubuntu0.2
    • 0.8.0~20170825.94fa1e38-1ubuntu0.5
    • 0.8.0~20170825.94fa1e38-1ubuntu0.6
    • 0.8.0~20170825.94fa1e38-1ubuntu0.7
    Affected ranges
    • ECOSYSTEM: < 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm3

    Update to 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm3

  • libssh Ubuntu:20.04:LTS

    Versions
    • 0.9.0-1ubuntu1
    • 0.9.0-1ubuntu4
    • 0.9.0-1ubuntu5
    • 0.9.3-2ubuntu1
    • 0.9.3-2ubuntu2
    • 0.9.3-2ubuntu2.1
    • 0.9.3-2ubuntu2.2
    • 0.9.3-2ubuntu2.3
    • 0.9.3-2ubuntu2.4
    Affected ranges
    • ECOSYSTEM: < 0.9.3-2ubuntu2.5

    Update to 0.9.3-2ubuntu2.5

  • libssh Ubuntu:22.04:LTS

    Versions
    • 0.9.6-1
    • 0.9.6-1build1
    • 0.9.6-2
    • 0.9.6-2build1
    • 0.9.6-2ubuntu0.22.04.1
    • 0.9.6-2ubuntu0.22.04.2
    Affected ranges
    • ECOSYSTEM: < 0.9.6-2ubuntu0.22.04.3

    Update to 0.9.6-2ubuntu0.22.04.3

Original sources

Check your server →