{"id":"CVE-2023-2283","aliases":["ALSA-2023:3839","ALSA-2023:6643","BELL-CVE-2023-2283","CLSA-2023-1691084556","CLSA-2023-1691084775","CLSA-2024-1718787931","DEBIAN-CVE-2023-2283","DSA-5409-1","EUVD-2023-33789","GHSA-h9jw-g3xj-5hwg","MGASA-2023-0184","OESA-2023-1291","OESA-2023-1305","OESA-2023-1306","OESA-2023-1329","RHSA-2023:3839","RHSA-2023:6643","RHSA-2024:0538","RLSA-2023:3839","SUSE-SU-2024:0140-1","SUSE-SU-2024:0525-1","SUSE-SU-2024:0539-1","UBUNTU-CVE-2023-2283","USN-6138-1","openSUSE-SU-2024:12914-1"],"status":"published","title":"A vulnerability was found in libssh, where the authentication check of the connecting client can...","description":"A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01061,"percentile":0.64818,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2023-05-09T00:00:00Z","modified":"2026-10-29T11:31:58Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh","fixed_in":["0.10.4-8.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh-config","fixed_in":["0.10.4-8.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh-devel","fixed_in":["0.10.4-8.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libssh","fixed_in":["0.10.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libssh","fixed_in":["0.10.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libssh","fixed_in":["0.10.5-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libssh","fixed_in":["0.9.3-2ubuntu2.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libssh","fixed_in":["0.9.6-2ubuntu0.22.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-10.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-10.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-10.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-11.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-11.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-11.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-8.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-8.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-8.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.5-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-0+deb11u1"}]}],"versions":["0.9.5-1","0.9.5-1+deb11u1","0.9.6-1","0.9.6-2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-7.oe2203"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-7.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-8.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-8.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-10.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-10.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-10.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-10.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-10.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-10.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-10.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-11.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-11.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-11.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-11.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-11.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-11.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-11.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-4.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-4.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-4.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-4.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-4.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-4.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-4.el8_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-10.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-3.12.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-3.12.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-3.12.2"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu2.3"}]}],"versions":["0.9.0-1ubuntu1","0.9.0-1ubuntu4","0.9.0-1ubuntu5","0.9.3-2ubuntu1","0.9.3-2ubuntu2","0.9.3-2ubuntu2.1","0.9.3-2ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-2ubuntu0.22.04.1"}]}],"versions":["0.9.6-1","0.9.6-1build1","0.9.6-2","0.9.6-2build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu2.3"}]}],"versions":["0.9.0-1ubuntu1","0.9.0-1ubuntu4","0.9.0-1ubuntu5","0.9.3-2ubuntu1","0.9.3-2ubuntu2","0.9.3-2ubuntu2.1","0.9.3-2ubuntu2.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-2ubuntu0.22.04.1"}]}],"versions":["0.9.6-1","0.9.6-1build1","0.9.6-2","0.9.6-2build1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.5-1.1"}]}],"bundled":2}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libssh","product":"libssh"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-2283","tags":["x_transferred","Third Party Advisory","report","web"]},{"url":"https://www.libssh.org/security/advisories/CVE-2023-2283.txt","tags":["x_transferred","Vendor Advisory","advisory","article","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2189736","tags":["x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27PD44ALQTZXX7K6JAM3BXBUHYA6DFFN/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"http://packetstormsecurity.com/files/172861/libssh-0.9.6-0.10.4-pki_verify_data_signature-Authorization-Bypass.html","tags":["x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202312-05","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240201-0005/","tags":["x_transferred","advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Feb/18","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2283","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27PD44ALQTZXX7K6JAM3BXBUHYA6DFFN"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27PD44ALQTZXX7K6JAM3BXBUHYA6DFFN"},{"url":"https://security.netapp.com/advisory/ntap-20240201-0005"},{"url":"https://github.com/advisories/GHSA-h9jw-g3xj-5hwg"},{"url":"https://access.redhat.com/errata/RHSA-2023:3839","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-1667","tags":["report"]},{"url":"https://bugzilla.redhat.com/2182199","tags":["report"]},{"url":"https://bugzilla.redhat.com/2189736","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-3839.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6643","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-6643.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-2283","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2023-1691084556.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2023-1691084775.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2024-1718787931.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2283.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-2283","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0184.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31925","tags":["report"]},{"url":"https://www.libssh.org/security/advisories/CVE-2023-1667.txt","tags":["advisory"]},{"url":"https://www.libssh.org/2023/05/04/libssh-0-10-5-and-libssh-0-9-7-security-releases/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/C4KR3JZOQP2PX7KTYELHWXLPT3JRJXUM/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1291","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1667","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1305","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1306","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1329","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2182199","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3839.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1667","tags":["advisory"]},{"url":"http://www.libssh.org/security/advisories/CVE-2023-1667.txt","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-2283","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6643.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0538","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254210","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0538.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-48795","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-48795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48795","tags":["advisory"]},{"url":"https://access.redhat.com/solutions/7071748","tags":["article"]},{"url":"https://terrapin-attack.com/","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2023:3839","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240140-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1211188","tags":["report"]},{"url":"https://bugzilla.suse.com/1211190","tags":["report"]},{"url":"https://bugzilla.suse.com/1218126","tags":["report"]},{"url":"https://bugzilla.suse.com/1218186","tags":["report"]},{"url":"https://bugzilla.suse.com/1218209","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6918","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240525-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1158095","tags":["report"]},{"url":"https://bugzilla.suse.com/1168699","tags":["report"]},{"url":"https://bugzilla.suse.com/1174713","tags":["report"]},{"url":"https://bugzilla.suse.com/1189608","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3634","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240539-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-2283","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6138-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-1667","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-2283","description":"A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.","status":"published","published":"2023-05-26T00:00:00Z","modified":"2025-11-03T20:35:18.528Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:35:24.360381Z"}],"euvd":[{"id":"EUVD-2023-33789","description":"A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.","status":"published","published":"2023-05-26T00:00:00Z","modified":"2025-11-03T20:35:18Z","updated_at":"2026-11-02T19:49:32.503916Z"}],"ghsa":[{"id":"GHSA-h9jw-g3xj-5hwg","title":"A vulnerability was found in libssh, where the authentication check of the connecting client can...","description":"A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.","status":"published","published":"2023-05-26T18:30:21Z","modified":"2025-11-03T21:31:51Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:04:19.274788Z"}],"nvd":[{"id":"CVE-2023-2283","description":"A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.","status":"published","published":"2023-05-26T18:15:13.77Z","modified":"2026-06-17T05:52:11.247Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:08:03.200773Z"}],"osv":[{"id":"BELL-CVE-2023-2283","title":"CVE-2023-2283 does not affect BellSoft software","status":"withdrawn","published":"2023-10-18T13:44:37.211884Z","modified":"2026-01-26T09:49:24.035271Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"DEBIAN-CVE-2023-2283","description":"A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.","status":"published","published":"2023-05-26T18:15:13.77Z","modified":"2026-10-26T18:00:30.316054577Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"OESA-2023-1291","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).\r\n\r\nSecurity Fix(es):\r\n\r\nA NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.(CVE-2023-1667)\r\n\r\nA vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.(CVE-2023-2283)","status":"published","published":"2023-05-26T11:05:45Z","modified":"2026-08-18T01:17:40.223634833Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1305","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).\r\n\r\nSecurity Fix(es):\r\n\r\nA NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.(CVE-2023-1667)\r\n\r\nA vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.(CVE-2023-2283)","status":"published","published":"2023-06-03T11:05:46Z","modified":"2026-08-18T01:17:41.624992504Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1306","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).\r\n\r\nSecurity Fix(es):\r\n\r\nA NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.(CVE-2023-1667)\r\n\r\nA vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.(CVE-2023-2283)","status":"published","published":"2023-06-03T11:05:46Z","modified":"2026-08-18T01:17:41.494009541Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1329","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).\r\n\r\nSecurity Fix(es):\r\n\r\nA NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.(CVE-2023-1667)\r\n\r\nA vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.(CVE-2023-2283)","status":"published","published":"2023-06-03T11:05:47Z","modified":"2026-08-18T01:16:57.502968547Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2023:3839","title":"Red Hat Security Advisory: libssh security update","status":"published","published":"2024-09-16T11:47:38Z","modified":"2026-06-30T10:04:09Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:6643","title":"Red Hat Security Advisory: libssh security update","status":"published","published":"2024-09-16T11:47:49Z","modified":"2026-06-30T10:04:53Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2024:0538","title":"Red Hat Security Advisory: libssh security update","status":"published","published":"2024-10-01T23:35:20Z","modified":"2026-10-17T10:02:50Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"UBUNTU-CVE-2023-2283","description":"A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.","status":"published","published":"2023-05-09T00:00:00Z","modified":"2026-04-22T14:02:51.464173Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"ALSA-2023:3839","title":"Moderate: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667)\n* libssh: authorization bypass in pki_verify_data_signature (CVE-2023-2283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-06-27T00:00:00Z","modified":"2026-10-29T11:02:09.231047922Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:6643","title":"Moderate: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667)\n* libssh: authorization bypass in pki_verify_data_signature (CVE-2023-2283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-07T00:00:00Z","modified":"2026-10-29T11:31:58.967708368Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"CLSA-2023-1691084556","title":"libssh: Fix of 2 CVEs","description":"- CVE-2023-2283: fix the authentication check\n- CVE-2023-1667: refactor the algorithm guessing to avoid NULL dereference\n- improve tests","status":"published","published":"2023-08-03T17:42:40Z","modified":"2026-10-21T10:48:05.533457865Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1691084775","title":"libssh: Fix of 2 CVEs","description":"- CVE-2023-2283: fix the authentication check\n- CVE-2023-1667: refactor the algorithm guessing to avoid NULL dereference\n- improve tests","status":"published","published":"2023-08-03T17:46:24Z","modified":"2026-10-21T10:48:00.096076141Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2024-1718787931","title":"libssh: Fix of CVE-2023-2283","description":"- CVE-2023-2283: src/pki_crypto.c: fix possible authentication bypass, remove\n  unneccessary null check; tests/client/torture_rekey.c: fix tests","status":"published","published":"2024-06-19T09:05:34Z","modified":"2026-06-01T00:30:15.600693932Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CVE-2023-2283","description":"A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.","status":"published","published":"2023-05-26T00:00:00Z","modified":"2026-10-28T02:30:40.782126812Z","cwes":["CWE-287"],"updated_at":"2026-11-02T15:44:30.334753Z"},{"id":"DSA-5409-1","title":"libssh - security update","status":"published","published":"2023-05-23T00:00:00Z","modified":"2026-03-09T02:09:37.02411Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2023-0184","title":"Updated libssh packages fix security vulnerability","description":"Potential NULL dereference during rekeying with algorithm guessing.\n(CVE-2023-1667)\nAuthorization bypass in pki_verify_data_signature. (CVE-2023-2283\n","status":"published","published":"2023-05-21T08:42:44Z","modified":"2026-04-16T04:43:54.626271739Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12914-1","title":"libssh-config-0.10.5-1.1 on GA media","description":"These are all security issues fixed in the libssh-config-0.10.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:22:18.581394Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"RLSA-2023:3839","title":"Moderate: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667)\n\n* libssh: authorization bypass in pki_verify_data_signature (CVE-2023-2283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-07-08T02:54:11.077184Z","modified":"2026-02-05T03:00:11.505914Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2024:0140-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\nSecurity fixes:\n\n  - CVE-2023-6004: Fixed command injection using proxycommand (bsc#1218209)\n  - CVE-2023-48795: Fixed potential downgrade attack using strict kex (bsc#1218126)\n  - CVE-2023-6918: Fixed missing checks for return values of MD functions (bsc#1218186)\n  - CVE-2023-1667: Fixed NULL dereference during rekeying with algorithm  guessing (bsc#1211188)\n  - CVE-2023-2283: Fixed possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190)\n\nOther fixes:\n\n- Update to version 0.9.8\n  - Allow @ in usernames when parsing from URI composes\n\n- Update to version 0.9.7\n  - Fix several memory leaks in GSSAPI handling code\n","status":"published","published":"2024-01-18T10:35:00Z","modified":"2026-02-04T04:28:51.17128Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0525-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\nUpdate to version 0.9.8 (jsc#PED-7719):\n\n* Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209)\n* Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126)\n* Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186)\n* Allow @ in usernames when parsing from URI composes\n\nUpdate to version 0.9.7:\n\n* Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm\n  guessing (bsc#1211188)\n* Fix CVE-2023-2283: a possible authorization bypass in\n  pki_verify_data_signature under low-memory conditions (bsc#1211190)\n* Fix several memory leaks in GSSAPI handling code\n\nUpdate to version 0.9.6 (bsc#1189608, CVE-2021-3634):\n\n* https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6\n\n\nUpdate to 0.9.5 (bsc#1174713, CVE-2020-16135):\n\n* CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232)\n* Improve handling of library initialization (T222)\n* Fix parsing of subsecond times in SFTP (T219)\n* Make the documentation reproducible\n* Remove deprecated API usage in OpenSSL\n* Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN\n* Define version in one place (T226)\n* Prevent invalid free when using different C runtimes than OpenSSL (T229)\n* Compatibility improvements to testsuite \n\nUpdate to version 0.9.4\n\n* https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/\n* Fix possible Denial of Service attack when using AES-CTR-ciphers\n  CVE-2020-1730 (bsc#1168699)\n\nUpdate to version 0.9.3\n\n* Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095)\n* SSH-01-003 Client: Missing NULL check leads to crash in erroneous state\n* SSH-01-006 General: Various unchecked Null-derefs cause DOS\n* SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys\n* SSH-01-010 SSH: Deprecated hash function in fingerprinting\n* SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS\n* SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access\n* SSH-01-001 State Machine: Initial machine states should be set explicitly\n* SSH-01-002 Kex: Differently bound macros used to iterate same array\n* SSH-01-005 Code-Quality: Integer sign confusion during assignments\n* SSH-01-008 SCP: Protocol Injection via unescaped File Names\n* SSH-01-009 SSH: Update documentation which RFCs are implemented\n* SSH-01-012 PKI: Information leak via uninitialized stack buffer\n\nUpdate to version 0.9.2\n\n* Fixed libssh-config.cmake\n* Fixed issues with rsa algorithm negotiation (T191)\n* Fixed detection of OpenSSL ed25519 support (T197)\n\nUpdate to version 0.9.1\n\n* Added support for Ed25519 via OpenSSL\n* Added support for X25519 via OpenSSL\n* Added support for localuser in Match keyword\n* Fixed Match keyword to be case sensitive\n* Fixed compilation with LibreSSL\n* Fixed error report of channel open (T75)\n* Fixed sftp documentation (T137)\n* Fixed known_hosts parsing (T156)\n* Fixed build issue with MinGW (T157)\n* Fixed build with gcc 9 (T164)\n* Fixed deprecation issues (T165)\n* Fixed known_hosts directory creation (T166)\n\n- Split out configuration to separate package to not mess up the\n  library packaging and coinstallation\n\nUpdate to verion 0.9.0\n\n* Added support for AES-GCM\n* Added improved rekeying support\n* Added performance improvements\n* Disabled blowfish support by default\n* Fixed several ssh config parsing issues\n* Added support for DH Group Exchange KEX\n* Added support for Encrypt-then-MAC mode\n* Added support for parsing server side configuration file\n* Added support for ECDSA/Ed25519 certificates\n* Added FIPS 140-2 compatibility\n* Improved known_hosts parsing\n* Improved documentation\n* Improved OpenSSL API usage for KEX, DH, and signatures\n\n- Add libssh client and server config files\n","status":"published","published":"2024-02-19T07:04:14Z","modified":"2026-02-04T03:01:50.419082Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0539-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\nUpdate to version 0.9.8 (jsc#PED-7719):\n\n* Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209)\n* Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126)\n* Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186)\n* Allow @ in usernames when parsing from URI composes\n\nUpdate to version 0.9.7\n\n* Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm\n  guessing (bsc#1211188)\n* Fix CVE-2023-2283: a possible authorization bypass in\n  pki_verify_data_signature under low-memory conditions (bsc#1211190)\n* Fix several memory leaks in GSSAPI handling code\n\nUpdate to version 0.9.6 (bsc#1189608, CVE-2021-3634)\n\n* https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6\n\nUpdate to version 0.9.5 (bsc#1174713, CVE-2020-16135):\n\n* CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232)\n* Improve handling of library initialization (T222)\n* Fix parsing of subsecond times in SFTP (T219)\n* Make the documentation reproducible\n* Remove deprecated API usage in OpenSSL\n* Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN\n* Define version in one place (T226)\n* Prevent invalid free when using different C runtimes than OpenSSL (T229)\n* Compatibility improvements to testsuite \n\nUpdate to version 0.9.4:\n\n* https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/\n* Fix possible Denial of Service attack when using AES-CTR-ciphers\n  CVE-2020-1730 (bsc#1168699)\n\nUpdate to version 0.9.3:\n\n* Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095)\n* SSH-01-003 Client: Missing NULL check leads to crash in erroneous state\n* SSH-01-006 General: Various unchecked Null-derefs cause DOS\n* SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys\n* SSH-01-010 SSH: Deprecated hash function in fingerprinting\n* SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS\n* SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access\n* SSH-01-001 State Machine: Initial machine states should be set explicitly\n* SSH-01-002 Kex: Differently bound macros used to iterate same array\n* SSH-01-005 Code-Quality: Integer sign confusion during assignments\n* SSH-01-008 SCP: Protocol Injection via unescaped File Names\n* SSH-01-009 SSH: Update documentation which RFCs are implemented\n* SSH-01-012 PKI: Information leak via uninitialized stack buffer\n\nUpdate to version 0.9.2:\n\n* Fixed libssh-config.cmake\n* Fixed issues with rsa algorithm negotiation (T191)\n* Fixed detection of OpenSSL ed25519 support (T197)\n\nUpdate to version 0.9.1:\n\n* Added support for Ed25519 via OpenSSL\n* Added support for X25519 via OpenSSL\n* Added support for localuser in Match keyword\n* Fixed Match keyword to be case sensitive\n* Fixed compilation with LibreSSL\n* Fixed error report of channel open (T75)\n* Fixed sftp documentation (T137)\n* Fixed known_hosts parsing (T156)\n* Fixed build issue with MinGW (T157)\n* Fixed build with gcc 9 (T164)\n* Fixed deprecation issues (T165)\n* Fixed known_hosts directory creation (T166)\n\nUpdate to verion 0.9.0:\n\n* Added support for AES-GCM\n* Added improved rekeying support\n* Added performance improvements\n* Disabled blowfish support by default\n* Fixed several ssh config parsing issues\n* Added support for DH Group Exchange KEX\n* Added support for Encrypt-then-MAC mode\n* Added support for parsing server side configuration file\n* Added support for ECDSA/Ed25519 certificates\n* Added FIPS 140-2 compatibility\n* Improved known_hosts parsing\n* Improved documentation\n* Improved OpenSSL API usage for KEX, DH, and signatures\n\n- Add libssh client and server config files\n","status":"published","published":"2024-02-20T15:03:55Z","modified":"2026-02-04T03:19:38.620325Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"USN-6138-1","title":"libssh vulnerabilities","description":"Philip Turnbull discovered that libssh incorrectly handled rekeying with\nalgorithm guessing. A remote attacker could use this issue to cause libssh\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2023-1667)\n\nKevin Backhouse discovered that libssh incorrectly handled verifying data\nsignatures. A remote attacker could possibly use this issue to bypass\nauthorization. (CVE-2023-2283)\n","status":"published","published":"2023-06-05T14:08:01Z","modified":"2026-04-22T10:36:32.463178Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}