Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2025:03368-1

Опубликовано: 26 сент. 2025
Источник: suse-cvrf

Описание

Security update for libssh

This update for libssh fixes the following issues:

  • CVE-2025-8277: memory exhaustion leading to client-side DoS due to improper memory management when KEX process is repeated with incorrect guesses (bsc#1249375).
  • CVE-2025-8114: NULL pointer dereference when an allocation error happens during the calculation of the KEX session ID (bsc#1246974).

Список пакетов

Container suse/ltss/sle12.5/sles12sp5:latest
libssh-config-0.9.8-3.18.1
libssh4-0.9.8-3.18.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
libssh-config-0.9.8-3.18.1
libssh-devel-0.9.8-3.18.1
libssh4-0.9.8-3.18.1
libssh4-32bit-0.9.8-3.18.1

Ссылки

Описание

A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.

Затронутые продукты
Container suse/ltss/sle12.5/sles12sp5:latest:libssh-config-0.9.8-3.18.1
Container suse/ltss/sle12.5/sles12sp5:latest:libssh4-0.9.8-3.18.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libssh-config-0.9.8-3.18.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libssh-devel-0.9.8-3.18.1
Ссылки

Описание

A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.

Затронутые продукты
Container suse/ltss/sle12.5/sles12sp5:latest:libssh-config-0.9.8-3.18.1
Container suse/ltss/sle12.5/sles12sp5:latest:libssh4-0.9.8-3.18.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libssh-config-0.9.8-3.18.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libssh-devel-0.9.8-3.18.1
Ссылки
Уязвимость SUSE-SU-2025:03368-1