Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3074-1

Опубликовано: 16 июл. 2026
Источник: suse-cvrf

Описание

Security update for libssh2_org

This update for libssh2_org fixes the following issue

Security changes:

  • CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530).

Other changes:

  • rebuild libssh2_org against openssl 1.1.1, enabling ed25519 support. (bsc#1227490)

Список пакетов

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
libssh2-1-1.11.0-150200.9.5.1
libssh2-devel-1.11.0-150200.9.5.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
libssh2-1-1.11.0-150200.9.5.1
libssh2-devel-1.11.0-150200.9.5.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
libssh2-1-1.11.0-150200.9.5.1
libssh2-1-32bit-1.11.0-150200.9.5.1
libssh2-devel-1.11.0-150200.9.5.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
libssh2-1-1.11.0-150200.9.5.1
libssh2-1-32bit-1.11.0-150200.9.5.1
libssh2-devel-1.11.0-150200.9.5.1
SUSE Linux Enterprise Micro 5.3
libssh2-1-1.11.0-150200.9.5.1
SUSE Linux Enterprise Micro 5.4
libssh2-1-1.11.0-150200.9.5.1
SUSE Linux Enterprise Micro 5.5
libssh2-1-1.11.0-150200.9.5.1
SUSE Linux Enterprise Server 15 SP4-LTSS
libssh2-1-1.11.0-150200.9.5.1
libssh2-1-32bit-1.11.0-150200.9.5.1
libssh2-devel-1.11.0-150200.9.5.1
SUSE Linux Enterprise Server 15 SP5-LTSS
libssh2-1-1.11.0-150200.9.5.1
libssh2-1-32bit-1.11.0-150200.9.5.1
libssh2-devel-1.11.0-150200.9.5.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4
libssh2-1-1.11.0-150200.9.5.1
libssh2-devel-1.11.0-150200.9.5.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5
libssh2-1-1.11.0-150200.9.5.1
libssh2-1-32bit-1.11.0-150200.9.5.1
libssh2-devel-1.11.0-150200.9.5.1

Ссылки

Описание

libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.

Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libssh2-1-1.11.0-150200.9.5.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libssh2-devel-1.11.0-150200.9.5.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libssh2-1-1.11.0-150200.9.5.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libssh2-devel-1.11.0-150200.9.5.1
Ссылки