Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2016:0723-1

Опубликовано: 11 мар. 2016
Источник: suse-cvrf

Описание

Security update for libssh2_org

This update for libssh2_org fixes the following issues:

  • Add SHA256 support for DH group exchange (fate#320343, bsc#961964)

  • fix CVE-2016-0787 (bsc#967026)

    • Weakness in diffie-hellman secret key generation lead to much shorter DH groups then needed, which could be used to retrieve server keys.

Список пакетов

SUSE Linux Enterprise Desktop 11 SP4
libssh2-1-1.2.9-4.2.6.1
SUSE Linux Enterprise Server 11 SP4
libssh2-1-1.2.9-4.2.6.1
SUSE Linux Enterprise Server for SAP Applications 11 SP4
libssh2-1-1.2.9-4.2.6.1
SUSE Linux Enterprise Software Development Kit 11 SP4
libssh2-1-1.2.9-4.2.6.1
libssh2-1-32bit-1.2.9-4.2.6.1
libssh2-1-x86-1.2.9-4.2.6.1
libssh2-devel-1.2.9-4.2.6.1

Ссылки

Описание

The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."

Затронутые продукты
SUSE Linux Enterprise Desktop 11 SP4:libssh2-1-1.2.9-4.2.6.1
SUSE Linux Enterprise Server 11 SP4:libssh2-1-1.2.9-4.2.6.1
SUSE Linux Enterprise Server for SAP Applications 11 SP4:libssh2-1-1.2.9-4.2.6.1
SUSE Linux Enterprise Software Development Kit 11 SP4:libssh2-1-1.2.9-4.2.6.1
Ссылки