USN-3795-3
libssh regression
USN-3795-1 and USN-3795-2 fixed a vulnerability in libssh. The upstream fix introduced a regression. This update fixes the problem.
Original advisory details:
Peter Winter-Smith discovered that libssh incorrectly handled authentication when being used as a server. A remote attacker could use this issue to bypass authentication without any credentials.
What each source reports
OSV No score
libssh regression
USN-3795-1 and USN-3795-2 fixed a vulnerability in libssh. The upstream fix introduced a regression. This update fixes the problem.
Original advisory details:
Peter Winter-Smith discovered that libssh incorrectly handled authentication when being used as a server. A remote attacker could use this issue to bypass authentication without any credentials.
- Record
USN-3795-3- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libsshUbuntu:14.04:LTS |
before 0.6.1-0ubuntu3.5, plus listed versions 0.5.4-10.6.1-0ubuntu20.6.1-0ubuntu30.6.1-0ubuntu3.10.6.1-0ubuntu3.30.6.1-0ubuntu3.4 |
0.6.1-0ubuntu3.5 |
libsshUbuntu:16.04:LTS |
before 0.6.3-4.3ubuntu0.2, plus listed versions 0.6.3-3ubuntu30.6.3-4.10.6.3-4.20.6.3-4.2ubuntu10.6.3-4.30.6.3-4.3ubuntu0.1 |
0.6.3-4.3ubuntu0.2 |
libsshUbuntu:18.04:LTS |
before 0.8.0~20170825.94fa1e38-1ubuntu0.2, plus listed versions 0.7.5-10.8.0~20170825.94fa1e38-10.8.0~20170825.94fa1e38-1build10.8.0~20170825.94fa1e38-1ubuntu0.1 |
0.8.0~20170825.94fa1e38-1ubuntu0.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-3795-3 is a vulnerability with no CVSS score yet in libssh, published November 29, 2018. No source lists public exploit code. Fixed in libssh 0.6.1-0ubuntu3.5.