Описание
Moderate: libssh security, bug fix, and enhancement update
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.
The following packages have been upgraded to a later upstream version: libssh (0.9.4). (BZ#1804797)
Security Fix(es):
-
libssh: denial of service when handling AES-CTR (or DES) ciphers (CVE-2020-1730)
-
libssh: unsanitized location in scp could lead to unwanted command execution (CVE-2019-14889)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.
Затронутые продукты
Rocky Linux 8
Связанные CVE
Исправления
- Red Hat - 1733914
- Red Hat - 1772523
- Red Hat - 1801998
- Red Hat - 1804797
- Red Hat - 1821339
- Red Hat - 1849071
Связанные уязвимости
ELSA-2020-4545: libssh security, bug fix, and enhancement update (MODERATE)
A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.
A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.