Описание
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 0.12.2-1 |
| esm-infra-legacy/xenial | not-affected | 0.12.0+ only |
| esm-infra/bionic | not-affected | 0.12.0+ only |
| esm-infra/focal | not-affected | 0.12.0+ only |
| jammy | not-affected | 0.12.0+ only |
| noble | not-affected | 0.12.0+ only |
| resolute | not-affected | 0.12.0+ only |
| upstream | released | 0.12.1-1 |
Показывать по
EPSS
8.8 High
CVSS3
Связанные уязвимости
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, ...
EPSS
8.8 High
CVSS3