{"id":"CVE-2023-6004","aliases":["ALPINE-CVE-2023-6004","ALSA-2024:2504","ALSA-2024:3233","AZL-34942","BELL-CVE-2023-6004","CLSA-2024-1709547699","CLSA-2024-1709561144","CLSA-2024-1709562050","CLSA-2024-1709562468","CLSA-2024-1709563150","DEBIAN-CVE-2023-6004","DSA-5591-1","EUVD-2023-58271","GHSA-f35j-mfvw-p857","MGASA-2023-0357","OESA-2024-1040","OESA-2024-1041","OESA-2024-1044","OESA-2024-1045","OESA-2024-1089","OESA-2024-1123","RHSA-2024:2504","RHSA-2024:3233","RLSA-2024:2504","RLSA-2024:3233","SUSE-SU-2024:0140-1","SUSE-SU-2024:0525-1","SUSE-SU-2024:0539-1","UBUNTU-CVE-2023-6004","USN-6592-1","USN-6592-2","openSUSE-SU-2024:13638-1"],"status":"published","title":"Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname","description":"A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00449,"percentile":0.39297,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2023-12-19T05:58:31.996508Z","modified":"2026-11-03T06:32:44Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"libssh","fixed_in":["0.10.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libssh","fixed_in":["0.10.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libssh","fixed_in":["0.10.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libssh","fixed_in":["0.10.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libssh","fixed_in":["0.10.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libssh","fixed_in":["0.10.6-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libssh","fixed_in":["0.10.6-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libssh","fixed_in":["0.10.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libssh","fixed_in":["0.10.6-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libssh","fixed_in":["0.10.6-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libssh","fixed_in":["0.10.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libssh","fixed_in":["0.10.6-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"libssh","fixed_in":["0.9.6-8.oe2203sp2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libssh","fixed_in":["0.6.3-4.3ubuntu0.6+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libssh","fixed_in":["0.8.0~20170825.94fa1e38-1ubuntu0.7+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libssh","fixed_in":["0.9.3-2ubuntu2.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libssh","fixed_in":["0.9.6-2ubuntu0.22.04.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.0"},{"fixed":"0.10.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.0"},{"fixed":"0.10.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.0"},{"fixed":"0.10.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.0"},{"fixed":"0.10.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.0"},{"fixed":"0.10.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.0"},{"fixed":"0.10.6-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-13.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-13.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-13.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.4-r0"},{"fixed":"0.10.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.6-r1"},{"fixed":"0.10.6-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-8.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-8.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-8.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libssh-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-4.3ubuntu0.6+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libssh-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-4.3ubuntu0.6+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libssh-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-4.3ubuntu0.6+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libssh-gcrypt-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-4.3ubuntu0.6+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libssh-gcrypt-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-4.3ubuntu0.6+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libssh-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libssh-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libssh-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libssh-gcrypt-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libssh-gcrypt-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-0+deb12u1"}]}],"versions":["0.10.5-2","0.10.5-3","0.10.5-3+hurd.1"]},{"source":"osv","ecosystem":"Debian:13","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-0+deb11u1"}]}],"versions":["0.9.5-1","0.9.5-1+deb11u1","0.9.6-1","0.9.6-2","0.9.7-0+deb11u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-0+deb12u1"}]}],"versions":["0.10.5-2","0.10.5-3","0.10.5-3+hurd.1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-8.oe2203"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-8.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-9.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-9.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-8.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-8.oe2203sp2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-13.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-13.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-13.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-13.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-13.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-13.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-13.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-13.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-3.12.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-3.12.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-3.12.2"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-4.3ubuntu0.6+esm1"}]}],"versions":["0.6.3-3ubuntu3","0.6.3-4.1","0.6.3-4.2","0.6.3-4.2ubuntu1","0.6.3-4.3","0.6.3-4.3ubuntu0.1","0.6.3-4.3ubuntu0.2","0.6.3-4.3ubuntu0.5","0.6.3-4.3ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~20170825.94fa1e38-1ubuntu0.7+esm3"}]}],"versions":["0.7.5-1","0.8.0~20170825.94fa1e38-1","0.8.0~20170825.94fa1e38-1build1","0.8.0~20170825.94fa1e38-1ubuntu0.1","0.8.0~20170825.94fa1e38-1ubuntu0.2","0.8.0~20170825.94fa1e38-1ubuntu0.5","0.8.0~20170825.94fa1e38-1ubuntu0.6","0.8.0~20170825.94fa1e38-1ubuntu0.7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu2.5"}]}],"versions":["0.9.0-1ubuntu1","0.9.0-1ubuntu4","0.9.0-1ubuntu5","0.9.3-2ubuntu1","0.9.3-2ubuntu2","0.9.3-2ubuntu2.1","0.9.3-2ubuntu2.2","0.9.3-2ubuntu2.3","0.9.3-2ubuntu2.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-2ubuntu0.22.04.3"}]}],"versions":["0.9.6-1","0.9.6-1build1","0.9.6-2","0.9.6-2build1","0.9.6-2ubuntu0.22.04.1","0.9.6-2ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu2.5"}]}],"versions":["0.9.0-1ubuntu1","0.9.0-1ubuntu4","0.9.0-1ubuntu5","0.9.3-2ubuntu1","0.9.3-2ubuntu2","0.9.3-2ubuntu2.1","0.9.3-2ubuntu2.2","0.9.3-2ubuntu2.3","0.9.3-2ubuntu2.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-2ubuntu0.22.04.3"}]}],"versions":["0.9.6-1","0.9.6-1build1","0.9.6-2","0.9.6-2build1","0.9.6-2ubuntu0.22.04.1","0.9.6-2ubuntu0.22.04.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-4.3ubuntu0.6+esm1"}]}],"versions":["0.6.3-3ubuntu3","0.6.3-4.1","0.6.3-4.2","0.6.3-4.2ubuntu1","0.6.3-4.3","0.6.3-4.3ubuntu0.1","0.6.3-4.3ubuntu0.2","0.6.3-4.3ubuntu0.5","0.6.3-4.3ubuntu0.6"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~20170825.94fa1e38-1ubuntu0.7+esm3"}]}],"versions":["0.7.5-1","0.8.0~20170825.94fa1e38-1","0.8.0~20170825.94fa1e38-1build1","0.8.0~20170825.94fa1e38-1ubuntu0.1","0.8.0~20170825.94fa1e38-1ubuntu0.2","0.8.0~20170825.94fa1e38-1ubuntu0.5","0.8.0~20170825.94fa1e38-1ubuntu0.6","0.8.0~20170825.94fa1e38-1ubuntu0.7"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-1.1"}]}],"bundled":3}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libssh","product":"libssh"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:2504","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3233","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-6004","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Vendor Advisory","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251110","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","report"]},{"url":"https://www.libssh.org/security/advisories/CVE-2023-6004.txt","tags":["x_transferred","Mailing List","advisory","article","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/","tags":["x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240223-0004/","tags":["x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6004","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM"},{"url":"https://security.netapp.com/advisory/ntap-20240223-0004"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB"},{"url":"https://github.com/advisories/GHSA-f35j-mfvw-p857"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-6004","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-6918","tags":["report"]},{"url":"https://bugzilla.redhat.com/2251110","tags":["report"]},{"url":"https://bugzilla.redhat.com/2254997","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2504.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-3233.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-6004","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2023-11","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2024-1709547699.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2024-1709561144.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2024-1709562050.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2024-1709562468.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2024-1709563150.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6004.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-6004","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0357.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32660","tags":["report"]},{"url":"https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/","tags":["web","article"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6918","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1041","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1044","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1045","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1089","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48795","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1123","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254997","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2504.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-6004","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-6918","tags":["advisory"]},{"url":"https://www.libssh.org/security/advisories/CVE-2023-6918.txt","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3233.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:2504","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:3233","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240140-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1211188","tags":["report"]},{"url":"https://bugzilla.suse.com/1211190","tags":["report"]},{"url":"https://bugzilla.suse.com/1218126","tags":["report"]},{"url":"https://bugzilla.suse.com/1218186","tags":["report"]},{"url":"https://bugzilla.suse.com/1218209","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6918","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240525-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1158095","tags":["report"]},{"url":"https://bugzilla.suse.com/1168699","tags":["report"]},{"url":"https://bugzilla.suse.com/1174713","tags":["report"]},{"url":"https://bugzilla.suse.com/1189608","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3634","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240539-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-6004","tags":["report"]},{"url":"https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6592-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6592-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-6918","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-6004","title":"Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname","description":"A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.","status":"published","published":"2024-01-03T17:01:38.672Z","modified":"2026-11-06T13:40:03.637Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-06T14:58:28.173309Z"}],"euvd":[{"id":"EUVD-2023-58271","description":"A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.","status":"published","published":"2024-01-03T17:01:38Z","modified":"2026-11-06T13:40:03Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-06T15:05:10.688381Z"}],"ghsa":[{"id":"GHSA-f35j-mfvw-p857","title":"A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit...","description":"A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.","status":"published","published":"2024-01-03T18:30:51Z","modified":"2025-11-04T21:30:54Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:04:36.009389Z"}],"nvd":[{"id":"CVE-2023-6004","description":"A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.","status":"published","published":"2024-01-03T17:15:11.623Z","modified":"2026-11-06T14:17:01.017Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-06T16:00:30.581664Z"}],"osv":[{"id":"ALPINE-CVE-2023-6004","description":"A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.","status":"published","published":"2024-01-03T17:15:11.623Z","modified":"2026-11-03T06:32:44.128465834Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"AZL-34942","title":"CVE-2023-6004 affecting package libssh for versions less than 0.10.6-1","description":"A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.","status":"published","published":"2024-01-03T17:15:11Z","modified":"2026-04-21T04:34:22.149613Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"BELL-CVE-2023-6004","status":"published","published":"2023-12-19T05:58:31.996508Z","modified":"2026-01-26T09:34:39.737348Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2023-6004","title":"Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname","description":"A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.","status":"published","published":"2024-01-03T17:01:38.672Z","modified":"2026-11-07T02:30:21.18729451Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-07T03:07:52.010191Z"},{"id":"DEBIAN-CVE-2023-6004","description":"A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.","status":"published","published":"2024-01-03T17:15:11.623Z","modified":"2026-11-07T09:47:31.351390731Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"OESA-2024-1040","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.(CVE-2023-6004)\r\n\r\nA flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.(CVE-2023-6918)","status":"published","published":"2024-01-12T11:06:29Z","modified":"2026-08-18T01:18:12.256372145Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1041","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.(CVE-2023-6004)\r\n\r\nA flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.(CVE-2023-6918)","status":"published","published":"2024-01-12T11:06:29Z","modified":"2026-08-18T01:18:12.694912867Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1044","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.(CVE-2023-6004)\r\n\r\nA flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.(CVE-2023-6918)","status":"published","published":"2024-01-12T11:06:29Z","modified":"2026-08-18T01:18:13.584844101Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1045","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.(CVE-2023-6004)\r\n\r\nA flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.(CVE-2023-6918)","status":"published","published":"2024-01-12T11:06:29Z","modified":"2026-08-18T01:18:12.329296278Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1089","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).\r\n\r\nSecurity Fix(es):\r\n\r\nThe SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH\u0026apos;s use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.(CVE-2023-48795)\r\n\r\nA flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.(CVE-2023-6004)","status":"published","published":"2024-01-19T11:06:32Z","modified":"2026-08-18T01:18:13.749488372Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1123","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.(CVE-2023-6004)","status":"published","published":"2024-02-02T11:06:34Z","modified":"2026-08-18T01:18:14.607849876Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHSA-2024:2504","title":"Red Hat Security Advisory: libssh security update","status":"published","published":"2024-09-16T17:53:35Z","modified":"2026-06-26T12:22:38.712983542Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3233","title":"Red Hat Security Advisory: libssh security update","status":"published","published":"2024-09-16T17:53:43Z","modified":"2026-06-26T12:22:31.98757974Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RLSA-2024:2504","title":"Low: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname (CVE-2023-6004)\n\n* libssh: Missing checks for return values for digests (CVE-2023-6918)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section.","status":"published","published":"2025-05-07T19:13:03.633594Z","modified":"2025-10-07T17:38:07.151632Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2023-6004","description":"A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.","status":"published","published":"2024-01-03T17:15:00Z","modified":"2026-04-22T14:34:48.628793Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"ALSA-2024:2504","title":"Low: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname (CVE-2023-6004)\n* libssh: Missing checks for return values for digests (CVE-2023-6918)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:44.070216747Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:3233","title":"Low: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname (CVE-2023-6004)\n* libssh: Missing checks for return values for digests (CVE-2023-6918)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-05-22T00:00:00Z","modified":"2026-10-29T11:02:26.31596169Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2024-1709547699","title":"libssh: Fix of 2 CVEs","description":"- CVE-2023-6004: fix the possibility of injections through a hostname parameter\n  in the ProxyCommand/ProxyJump features\n- CVE-2023-6918: fix the issue when unchecked return values for digests may\n  cause DoS","status":"published","published":"2024-03-04T10:21:43Z","modified":"2026-06-01T00:30:16.985412236Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1709561144","title":"libssh: Fix of 2 CVEs","description":"- CVE-2023-6004: fix the possibility of injections through a hostname parameter\n  in the ProxyCommand/ProxyJump features\n- CVE-2023-6918: fix the issue when unchecked return values for digests may\n  cause DoS","status":"published","published":"2024-03-04T14:05:47Z","modified":"2026-06-01T00:33:12.038897858Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1709562050","title":"libssh: Fix of 2 CVEs","description":"- CVE-2023-6004: fix the possibility of injections through a hostname parameter\n  in the ProxyCommand/ProxyJump features\n- CVE-2023-6918: fix the issue when unchecked return values for digests may\n  cause DoS","status":"published","published":"2024-03-04T14:20:54Z","modified":"2026-06-01T00:33:22.29016982Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1709562468","title":"Fix CVE(s): CVE-2023-6004, CVE-2023-6918","description":"   * SECURITY UPDATE: ProxyCommand/ProxyJump features allow injection of\n     malicious code through hostname\n     - debian/patches/CVE-2023-6004-pre1.patch: move common parser functions\n       to config_parser.c\n     - debian/patches/CVE-2023-6004-pre2.patch: prevent possible segmentation\n       fault\n     - debian/patches/CVE-2023-6004-02.patch: allow multiple '@' in usernames\n     - debian/patches/CVE-2023-6004-03.patch: simplify the hostname parsing\n       in ssh_options_set\n     - debian/patches/CVE-2023-6004-04.patch: add function to check allowed\n       characters of a hostname\n     - debian/patches/CVE-2023-6004-05.patch: add test for\n       ssh_check_hostname_syntax\n     - debian/patches/CVE-2023-6004-06.patch: check for valid syntax\n       of a hostname if it is a domain name\n     - debian/patches/CVE-2023-6004-07.patch: add test for proxycommand\n       injection\n     - debian/patches/CVE-2023-6004-08.patch: add test for ssh_is_ipaddr\n     - debian/patches/CVE-2023-6004-09.patch: add ipv6 link-local check\n       for an ip address\n     - debian/patches/CVE-2023-6004-10.patch: add tests for ipv6 link-local\n     - debian/patches/CVE-2023-6004-regression1.patch: fix regression in IPv6\n       addresses in hostname parsing\n     - debian/patches/CVE-2023-6004-regression2.patch: increase test coverage\n       for IPv6 address parsing as hostnames\n     - CVE-2023-6004\n   * SECURITY UPDATE: Unchecked return values for digests may cause DoS\n     - debian/patches/CVE-2023-6918-1.patch: systematically check return values\n       when calculating digests\n     - debian/patches/CVE-2023-6918-2.patch: detect context init failures\n     - debian/patches/CVE-2023-6918-3.patch: code coverage for\n       ssh_get_pubkey_hash()\n     - CVE-2023-6918","status":"published","published":"2024-03-04T14:27:52Z","modified":"2026-06-04T10:03:55.223494Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1709563150","title":"Fix CVE(s): CVE-2023-6004, CVE-2023-6918","description":"   * SECURITY UPDATE: ProxyCommand/ProxyJump features allow injection of\n     malicious code through hostname\n     - debian/patches/CVE-2023-6004-pre1.patch: move common parser functions\n       to config_parser.c\n     - debian/patches/CVE-2023-6004-pre2.patch: prevent possible segmentation\n       fault\n     - debian/patches/CVE-2023-6004-02.patch: allow multiple '@' in usernames\n     - debian/patches/CVE-2023-6004-03.patch: simplify the hostname parsing\n       in ssh_options_set\n     - debian/patches/CVE-2023-6004-04.patch: add function to check allowed\n       characters of a hostname\n     - debian/patches/CVE-2023-6004-05.patch: add test for\n       ssh_check_hostname_syntax\n     - debian/patches/CVE-2023-6004-06.patch: check for valid syntax\n       of a hostname if it is a domain name\n     - debian/patches/CVE-2023-6004-07.patch: add test for proxycommand\n       injection\n     - debian/patches/CVE-2023-6004-08.patch: add test for ssh_is_ipaddr\n     - debian/patches/CVE-2023-6004-09.patch: add ipv6 link-local check\n       for an ip address\n     - debian/patches/CVE-2023-6004-10.patch: add tests for ipv6 link-local\n     - debian/patches/CVE-2023-6004-regression1.patch: fix regression in IPv6\n       addresses in hostname parsing\n     - debian/patches/CVE-2023-6004-regression2.patch: increase test coverage\n       for IPv6 address parsing as hostnames\n     - CVE-2023-6004\n   * SECURITY UPDATE: Unchecked return values for digests may cause DoS\n     - debian/patches/CVE-2023-6918-1.patch: systematically check return values\n       when calculating digests\n     - debian/patches/CVE-2023-6918-2.patch: detect context init failures\n     - debian/patches/CVE-2023-6918-3.patch: code coverage for\n       ssh_get_pubkey_hash()\n     - CVE-2023-6918","status":"published","published":"2024-03-04T14:39:13Z","modified":"2026-06-04T10:04:20.073221Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"DSA-5591-1","title":"libssh - security update","status":"published","published":"2023-12-28T00:00:00Z","modified":"2026-03-09T02:10:57.648248Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2023-0357","title":"Updated libssh packages fix security vulnerabilities","description":"New version 0.10.6 for fixing security vulnerabilities of CVE-2023-6004,\nCVE-2023-48795 [Prefix Truncation Attacks in SSH Specification (Terrapin\nAttack)] and CVE-2023-6918.\n","status":"published","published":"2023-12-29T17:16:34Z","modified":"2026-04-16T04:42:19.045877027Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13638-1","title":"libssh-config-0.10.6-1.1 on GA media","description":"These are all security issues fixed in the libssh-config-0.10.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:53:29.789995Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"RLSA-2024:3233","title":"Low: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname (CVE-2023-6004)\n\n* libssh: Missing checks for return values for digests (CVE-2023-6918)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.","status":"published","published":"2024-06-14T13:59:16.809606Z","modified":"2026-02-04T21:45:08.406766Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2024:0140-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\nSecurity fixes:\n\n  - CVE-2023-6004: Fixed command injection using proxycommand (bsc#1218209)\n  - CVE-2023-48795: Fixed potential downgrade attack using strict kex (bsc#1218126)\n  - CVE-2023-6918: Fixed missing checks for return values of MD functions (bsc#1218186)\n  - CVE-2023-1667: Fixed NULL dereference during rekeying with algorithm  guessing (bsc#1211188)\n  - CVE-2023-2283: Fixed possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190)\n\nOther fixes:\n\n- Update to version 0.9.8\n  - Allow @ in usernames when parsing from URI composes\n\n- Update to version 0.9.7\n  - Fix several memory leaks in GSSAPI handling code\n","status":"published","published":"2024-01-18T10:35:00Z","modified":"2026-02-04T04:28:51.17128Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0525-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\nUpdate to version 0.9.8 (jsc#PED-7719):\n\n* Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209)\n* Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126)\n* Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186)\n* Allow @ in usernames when parsing from URI composes\n\nUpdate to version 0.9.7:\n\n* Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm\n  guessing (bsc#1211188)\n* Fix CVE-2023-2283: a possible authorization bypass in\n  pki_verify_data_signature under low-memory conditions (bsc#1211190)\n* Fix several memory leaks in GSSAPI handling code\n\nUpdate to version 0.9.6 (bsc#1189608, CVE-2021-3634):\n\n* https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6\n\n\nUpdate to 0.9.5 (bsc#1174713, CVE-2020-16135):\n\n* CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232)\n* Improve handling of library initialization (T222)\n* Fix parsing of subsecond times in SFTP (T219)\n* Make the documentation reproducible\n* Remove deprecated API usage in OpenSSL\n* Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN\n* Define version in one place (T226)\n* Prevent invalid free when using different C runtimes than OpenSSL (T229)\n* Compatibility improvements to testsuite \n\nUpdate to version 0.9.4\n\n* https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/\n* Fix possible Denial of Service attack when using AES-CTR-ciphers\n  CVE-2020-1730 (bsc#1168699)\n\nUpdate to version 0.9.3\n\n* Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095)\n* SSH-01-003 Client: Missing NULL check leads to crash in erroneous state\n* SSH-01-006 General: Various unchecked Null-derefs cause DOS\n* SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys\n* SSH-01-010 SSH: Deprecated hash function in fingerprinting\n* SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS\n* SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access\n* SSH-01-001 State Machine: Initial machine states should be set explicitly\n* SSH-01-002 Kex: Differently bound macros used to iterate same array\n* SSH-01-005 Code-Quality: Integer sign confusion during assignments\n* SSH-01-008 SCP: Protocol Injection via unescaped File Names\n* SSH-01-009 SSH: Update documentation which RFCs are implemented\n* SSH-01-012 PKI: Information leak via uninitialized stack buffer\n\nUpdate to version 0.9.2\n\n* Fixed libssh-config.cmake\n* Fixed issues with rsa algorithm negotiation (T191)\n* Fixed detection of OpenSSL ed25519 support (T197)\n\nUpdate to version 0.9.1\n\n* Added support for Ed25519 via OpenSSL\n* Added support for X25519 via OpenSSL\n* Added support for localuser in Match keyword\n* Fixed Match keyword to be case sensitive\n* Fixed compilation with LibreSSL\n* Fixed error report of channel open (T75)\n* Fixed sftp documentation (T137)\n* Fixed known_hosts parsing (T156)\n* Fixed build issue with MinGW (T157)\n* Fixed build with gcc 9 (T164)\n* Fixed deprecation issues (T165)\n* Fixed known_hosts directory creation (T166)\n\n- Split out configuration to separate package to not mess up the\n  library packaging and coinstallation\n\nUpdate to verion 0.9.0\n\n* Added support for AES-GCM\n* Added improved rekeying support\n* Added performance improvements\n* Disabled blowfish support by default\n* Fixed several ssh config parsing issues\n* Added support for DH Group Exchange KEX\n* Added support for Encrypt-then-MAC mode\n* Added support for parsing server side configuration file\n* Added support for ECDSA/Ed25519 certificates\n* Added FIPS 140-2 compatibility\n* Improved known_hosts parsing\n* Improved documentation\n* Improved OpenSSL API usage for KEX, DH, and signatures\n\n- Add libssh client and server config files\n","status":"published","published":"2024-02-19T07:04:14Z","modified":"2026-02-04T03:01:50.419082Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0539-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\nUpdate to version 0.9.8 (jsc#PED-7719):\n\n* Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209)\n* Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126)\n* Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186)\n* Allow @ in usernames when parsing from URI composes\n\nUpdate to version 0.9.7\n\n* Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm\n  guessing (bsc#1211188)\n* Fix CVE-2023-2283: a possible authorization bypass in\n  pki_verify_data_signature under low-memory conditions (bsc#1211190)\n* Fix several memory leaks in GSSAPI handling code\n\nUpdate to version 0.9.6 (bsc#1189608, CVE-2021-3634)\n\n* https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6\n\nUpdate to version 0.9.5 (bsc#1174713, CVE-2020-16135):\n\n* CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232)\n* Improve handling of library initialization (T222)\n* Fix parsing of subsecond times in SFTP (T219)\n* Make the documentation reproducible\n* Remove deprecated API usage in OpenSSL\n* Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN\n* Define version in one place (T226)\n* Prevent invalid free when using different C runtimes than OpenSSL (T229)\n* Compatibility improvements to testsuite \n\nUpdate to version 0.9.4:\n\n* https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/\n* Fix possible Denial of Service attack when using AES-CTR-ciphers\n  CVE-2020-1730 (bsc#1168699)\n\nUpdate to version 0.9.3:\n\n* Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095)\n* SSH-01-003 Client: Missing NULL check leads to crash in erroneous state\n* SSH-01-006 General: Various unchecked Null-derefs cause DOS\n* SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys\n* SSH-01-010 SSH: Deprecated hash function in fingerprinting\n* SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS\n* SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access\n* SSH-01-001 State Machine: Initial machine states should be set explicitly\n* SSH-01-002 Kex: Differently bound macros used to iterate same array\n* SSH-01-005 Code-Quality: Integer sign confusion during assignments\n* SSH-01-008 SCP: Protocol Injection via unescaped File Names\n* SSH-01-009 SSH: Update documentation which RFCs are implemented\n* SSH-01-012 PKI: Information leak via uninitialized stack buffer\n\nUpdate to version 0.9.2:\n\n* Fixed libssh-config.cmake\n* Fixed issues with rsa algorithm negotiation (T191)\n* Fixed detection of OpenSSL ed25519 support (T197)\n\nUpdate to version 0.9.1:\n\n* Added support for Ed25519 via OpenSSL\n* Added support for X25519 via OpenSSL\n* Added support for localuser in Match keyword\n* Fixed Match keyword to be case sensitive\n* Fixed compilation with LibreSSL\n* Fixed error report of channel open (T75)\n* Fixed sftp documentation (T137)\n* Fixed known_hosts parsing (T156)\n* Fixed build issue with MinGW (T157)\n* Fixed build with gcc 9 (T164)\n* Fixed deprecation issues (T165)\n* Fixed known_hosts directory creation (T166)\n\nUpdate to verion 0.9.0:\n\n* Added support for AES-GCM\n* Added improved rekeying support\n* Added performance improvements\n* Disabled blowfish support by default\n* Fixed several ssh config parsing issues\n* Added support for DH Group Exchange KEX\n* Added support for Encrypt-then-MAC mode\n* Added support for parsing server side configuration file\n* Added support for ECDSA/Ed25519 certificates\n* Added FIPS 140-2 compatibility\n* Improved known_hosts parsing\n* Improved documentation\n* Improved OpenSSL API usage for KEX, DH, and signatures\n\n- Add libssh client and server config files\n","status":"published","published":"2024-02-20T15:03:55Z","modified":"2026-02-04T03:19:38.620325Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"USN-6592-1","title":"libssh vulnerabilities","description":"It was discovered that libssh incorrectly handled the ProxyCommand and the\nProxyJump features. A remote attacker could possibly use this issue to\ninject malicious code into the command of the features mentioned through\nthe hostname parameter. (CVE-2023-6004)\n\nIt was discovered that libssh incorrectly handled return codes when\nperforming message digest operations. A remote attacker could possibly use\nthis issue to cause libssh to crash, obtain sensitive information, or\nexecute arbitrary code. (CVE-2023-6918)\n","status":"published","published":"2024-01-22T13:05:30Z","modified":"2026-04-22T10:43:55.163382Z","updated_at":"2026-11-02T16:58:17.305935Z"},{"id":"USN-6592-2","title":"libssh vulnerabilities","description":"USN-6592-1 fixed vulnerabilities in libssh. This update provides the\ncorresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that libssh incorrectly handled the ProxyCommand and the\n ProxyJump features. A remote attacker could possibly use this issue to\n inject malicious code into the command of the features mentioned through\n the hostname parameter. (CVE-2023-6004)\n\n It was discovered that libssh incorrectly handled return codes when\n performing message digest operations. A remote attacker could possibly use\n this issue to cause libssh to crash, obtain sensitive information, or\n execute arbitrary code. (CVE-2023-6918)\n","status":"published","published":"2024-02-05T13:02:16Z","modified":"2026-06-25T13:32:25.748258834Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}