USN-6585-1
libssh2 vulnerability
Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If a remote attacker was able to intercept SSH communications, extension negotiation messages could be truncated, possibly leading to certain algorithms and features being downgraded. This issue is known as the Terrapin attack. This update adds protocol extensions to mitigate this issue.
What each source reports
OSV No score
libssh2 vulnerability
Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If a remote attacker was able to intercept SSH communications, extension negotiation messages could be truncated, possibly leading to certain algorithms and features being downgraded. This issue is known as the Terrapin attack. This update adds protocol extensions to mitigate this issue.
- Record
USN-6585-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libssh2Ubuntu:23.10 |
before 1.11.0-2ubuntu0.1, plus listed versions 1.10.0-31.11.0-2 |
1.11.0-2ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-6585-1 is a vulnerability with no CVSS score yet in libssh2, published January 15, 2024. No source lists public exploit code. Fixed in libssh2 1.11.0-2ubuntu0.1.