Описание
A flaw was found in libssh. The API function ssh_get_hexa() is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to SSH_LOG_PACKET (3) or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.
Отчет
Attack Complexity is high as it requires the logging verbosity to be set to SSH_LOG_PACKET (3) or higher, which is not the default configuration in Red Hat Enterprise Linux.
Меры по смягчению последствий
Applications using libssh should avoid passing zero-length input to ssh_get_hexa(), ssh_get_fingerprint_hash(), and ssh_print_hexa(). For the remotely reachable GSSAPI authentication path, disable GSSAPI authentication in the affected libssh-based application if it is not required, or configure that application's libssh logging verbosity below SSH_LOG_PACKET (3). These measures address the GSSAPI logging path; they do not prevent other callers from passing zero-length input to the affected functions. Configuration and any required restart depend on the application using libssh. Changing the host's OpenSSH sshd_config or restarting the OpenSSH sshd service is not a general mitigation for applications using libssh. Apply the relevant vendor update containing the fix. Upstream fixed this issue in libssh 0.11.4 and 0.12.0; distribution packages may include a backported fix.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | libssh2 | Not affected | ||
| Red Hat Enterprise Linux 7 | libssh2 | Not affected | ||
| Red Hat Enterprise Linux 8 | libssh | Fix deferred | ||
| Red Hat Hardened Images | libssh2 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | libssh | Fixed | RHSA-2026:18160 | 19.05.2026 |
| Red Hat Enterprise Linux 9 | libssh | Fixed | RHSA-2026:18683 | 19.05.2026 |
| Red Hat Enterprise Linux 9 | libssh | Fixed | RHSA-2026:18683 | 19.05.2026 |
| Red Hat Hardened Images | libssh-main-0.12.0-1.1.hum1 | Fixed | RHSA-2026:7067 | 08.04.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.
A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.
Libssh: buffer underflow in ssh_get_hexa() on invalid input
A flaw was found in libssh. The API function `ssh_get_hexa()` is vulne ...
EPSS
6.5 Medium
CVSS3