[SECURITY] [DLA 2038-1] libssh security update

2019-12-1712:42:41

lists.debian.org

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.007 Low

EPSS

Percentile

80.4%

JSON

Package : libssh
Version : 0.6.3-4+deb8u4
CVE ID : CVE-2019-14889
Debian Bug : 946548

It was found that libssh, a tiny C SSH library, does not sufficiently
sanitize path parameters provided to the server, allowing an attacker
with only SCP file access to execute arbitrary commands on the server.

For Debian 8 "Jessie", this problem has been fixed in version
0.6.3-4+deb8u4.

We recommend that you upgrade your libssh packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10i386libssh-dev< 0.8.7-1+deb10u2libssh-dev_0.8.7-1+deb10u2_i386.deb
Debian8amd64libssh-dbg< 0.6.3-4+deb8u4libssh-dbg_0.6.3-4+deb8u4_amd64.deb
Debian8i386libssh-dbg< 0.6.3-4+deb8u4libssh-dbg_0.6.3-4+deb8u4_i386.deb
Debian10amd64libssh-4< 0.8.7-1+deb10u2libssh-4_0.8.7-1+deb10u2_amd64.deb
Debian8alllibssh< 0.6.3-4+deb8u4libssh_0.6.3-4+deb8u4_all.deb
Debian10alllibssh-doc< 0.8.7-1+deb10u2libssh-doc_0.8.7-1+deb10u2_all.deb
Debian10armhflibssh-gcrypt-dev< 0.8.7-1+deb10u2libssh-gcrypt-dev_0.8.7-1+deb10u2_armhf.deb
Debian8i386libssh-gcrypt-4< 0.6.3-4+deb8u4libssh-gcrypt-4_0.6.3-4+deb8u4_i386.deb
Debian10i386libssh-gcrypt-4< 0.8.7-1+deb10u2libssh-gcrypt-4_0.8.7-1+deb10u2_i386.deb
Debian8i386libssh-dev< 0.6.3-4+deb8u4libssh-dev_0.6.3-4+deb8u4_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	i386	libssh-dev	< 0.8.7-1+deb10u2	libssh-dev_0.8.7-1+deb10u2_i386.deb
Debian	8	amd64	libssh-dbg	< 0.6.3-4+deb8u4	libssh-dbg_0.6.3-4+deb8u4_amd64.deb
Debian	8	i386	libssh-dbg	< 0.6.3-4+deb8u4	libssh-dbg_0.6.3-4+deb8u4_i386.deb
Debian	10	amd64	libssh-4	< 0.8.7-1+deb10u2	libssh-4_0.8.7-1+deb10u2_amd64.deb
Debian	8	all	libssh	< 0.6.3-4+deb8u4	libssh_0.6.3-4+deb8u4_all.deb
Debian	10	all	libssh-doc	< 0.8.7-1+deb10u2	libssh-doc_0.8.7-1+deb10u2_all.deb
Debian	10	armhf	libssh-gcrypt-dev	< 0.8.7-1+deb10u2	libssh-gcrypt-dev_0.8.7-1+deb10u2_armhf.deb
Debian	8	i386	libssh-gcrypt-4	< 0.6.3-4+deb8u4	libssh-gcrypt-4_0.6.3-4+deb8u4_i386.deb
Debian	10	i386	libssh-gcrypt-4	< 0.8.7-1+deb10u2	libssh-gcrypt-4_0.8.7-1+deb10u2_i386.deb
Debian	8	i386	libssh-dev	< 0.6.3-4+deb8u4	libssh-dev_0.6.3-4+deb8u4_i386.deb