Описание
A flaw was found in libssh. The API function ssh_get_hexa() is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to SSH_LOG_PACKET (3) or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.
Отчет
Attack Complexity is high as it requires the logging verbosity to be set to SSH_LOG_PACKET (3) or higher, which is not the default configuration in Red Hat Enterprise Linux.
Меры по смягчению последствий
To mitigate this issue, consider disabling GSSAPI authentication if it is not required, or reduce the LogLevel in the sshd_config file to a value lower than SSH_LOG_PACKET (e.g., INFO).
To disable GSSAPI authentication, add or modify the following line in /etc/ssh/sshd_config:
GSSAPIAuthentication no
To reduce logging verbosity, add or modify the following line in /etc/ssh/sshd_config:
LogLevel INFO
After making changes to sshd_config, the sshd service must be restarted for the changes to take effect. This may temporarily interrupt active SSH sessions.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | libssh2 | Not affected | ||
| Red Hat Enterprise Linux 7 | libssh2 | Not affected | ||
| Red Hat Enterprise Linux 8 | libssh | Fix deferred | ||
| Red Hat Hardened Images | libssh2 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Fix deferred | ||
| Red Hat Enterprise Linux 10 | libssh | Fixed | RHSA-2026:18160 | 19.05.2026 |
| Red Hat Enterprise Linux 9 | libssh | Fixed | RHSA-2026:18683 | 19.05.2026 |
| Red Hat Enterprise Linux 9 | libssh | Fixed | RHSA-2026:18683 | 19.05.2026 |
| Red Hat Hardened Images | libssh-main-0.12.0-1.1.hum1 | Fixed | RHSA-2026:7067 | 08.04.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.
A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.
Libssh: buffer underflow in ssh_get_hexa() on invalid input
A flaw was found in libssh. The API function `ssh_get_hexa()` is vulne ...
The API function `ssh_get_hexa()` is vulnerable, when 0-lenght input is provided to this function. This function is used internally in `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated), which is vulnerable to the same input (length is provided by the calling application). The function is also used internally in the gssapi code for logging the OIDs received by the server during GSSAPI authentication. This could be triggered remotely, when the server allows GSSAPI authentication and logging verbosity is set at least to SSH_LOG_PACKET (3). This could cause self-DoS of the per-connection daemon process.
EPSS
6.5 Medium
CVSS3