Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2016:0718-1

Опубликовано: 11 мар. 2016
Источник: suse-cvrf

Описание

Security update for libssh2_org

This update for libssh2_org fixes the following issues:

Security issue fixed:

  • CVE-2016-0787 (bsc#967026): Weakness in diffie-hellman secret key generation lead to much shorter DH groups then needed, which could be used to retrieve server keys.

A feature was added:

  • Support of SHA256 digests for DH group exchanges was added (fate#320343, bsc#961964)

Bug fixed:

  • Properly detect EVP_aes_128_ctr at configure time (bsc#933336)

Список пакетов

SUSE Linux Enterprise Desktop 12
libssh2-1-1.4.3-16.1
libssh2-1-32bit-1.4.3-16.1
SUSE Linux Enterprise Desktop 12 SP1
libssh2-1-1.4.3-16.1
libssh2-1-32bit-1.4.3-16.1
SUSE Linux Enterprise Server 12
libssh2-1-1.4.3-16.1
libssh2-1-32bit-1.4.3-16.1
SUSE Linux Enterprise Server 12 SP1
libssh2-1-1.4.3-16.1
libssh2-1-32bit-1.4.3-16.1
SUSE Linux Enterprise Server for SAP Applications 12
libssh2-1-1.4.3-16.1
libssh2-1-32bit-1.4.3-16.1
SUSE Linux Enterprise Server for SAP Applications 12 SP1
libssh2-1-1.4.3-16.1
libssh2-1-32bit-1.4.3-16.1
SUSE Linux Enterprise Software Development Kit 12
libssh2-devel-1.4.3-16.1
SUSE Linux Enterprise Software Development Kit 12 SP1
libssh2-devel-1.4.3-16.1

Ссылки

Описание

The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP1:libssh2-1-1.4.3-16.1
SUSE Linux Enterprise Desktop 12 SP1:libssh2-1-32bit-1.4.3-16.1
SUSE Linux Enterprise Desktop 12:libssh2-1-1.4.3-16.1
SUSE Linux Enterprise Desktop 12:libssh2-1-32bit-1.4.3-16.1
Ссылки