Описание
Security update for libssh2_org
This update for libssh2_org fixes the following issues
- CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530).
- CVE-2026-55200: out-of-Bounds write via Unchecked packet_length in transport.c (bsc#1268531).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1268530
- SUSE Bug 1268531
- SUSE CVE CVE-2026-55199 page
- SUSE CVE CVE-2026-55200 page
Описание
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.
Затронутые продукты
Ссылки
- CVE-2026-55199
- SUSE Bug 1268530
Описание
libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.
Затронутые продукты
Ссылки
- CVE-2026-55200
- SUSE Bug 1268531