[SECURITY] [DSA 4322-1] libssh security update

2018-10-1716:16:35

lists.debian.org

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

JSON

Debian Security Advisory DSA-4322-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
October 17, 2018 https://www.debian.org/security/faq

Package : libssh
CVE ID : CVE-2018-10933
Debian Bug : 911149

Peter Winter-Smith of NCC Group discovered that libssh, a tiny C SSH
library, contains an authentication bypass vulnerability in the server
code. An attacker can take advantage of this flaw to successfully
authenticate without any credentials by presenting the server an
SSH2_MSG_USERAUTH_SUCCESS message in place of the
SSH2_MSG_USERAUTH_REQUEST message which the server would expect to
initiate authentication.

For the stable distribution (stretch), this problem has been fixed in
version 0.7.3-2+deb9u1.

We recommend that you upgrade your libssh packages.

For the detailed security status of libssh please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/libssh

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian9mipslibssh-4< 0.7.3-2+deb9u1libssh-4_0.7.3-2+deb9u1_mips.deb
Debian9i386libssh-dev< 0.7.3-2+deb9u1libssh-dev_0.7.3-2+deb9u1_i386.deb
Debian8armellibssh-gcrypt-dev< 0.6.3-4+deb8u3libssh-gcrypt-dev_0.6.3-4+deb8u3_armel.deb
Debian8i386libssh-4< 0.6.3-4+deb8u3libssh-4_0.6.3-4+deb8u3_i386.deb
Debian9i386libssh-gcrypt-dev< 0.7.3-2+deb9u1libssh-gcrypt-dev_0.7.3-2+deb9u1_i386.deb
Debian9ppc64ellibssh-gcrypt-4-dbgsym< 0.7.3-2+deb9u1libssh-gcrypt-4-dbgsym_0.7.3-2+deb9u1_ppc64el.deb
Debian9mipslibssh-gcrypt-dev< 0.7.3-2+deb9u1libssh-gcrypt-dev_0.7.3-2+deb9u1_mips.deb
Debian9amd64libssh-4< 0.7.3-2+deb9u1libssh-4_0.7.3-2+deb9u1_amd64.deb
Debian9ppc64ellibssh-dev< 0.7.3-2+deb9u1libssh-dev_0.7.3-2+deb9u1_ppc64el.deb
Debian8i386libssh-gcrypt-4< 0.6.3-4+deb8u3libssh-gcrypt-4_0.6.3-4+deb8u3_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	mips	libssh-4	< 0.7.3-2+deb9u1	libssh-4_0.7.3-2+deb9u1_mips.deb
Debian	9	i386	libssh-dev	< 0.7.3-2+deb9u1	libssh-dev_0.7.3-2+deb9u1_i386.deb
Debian	8	armel	libssh-gcrypt-dev	< 0.6.3-4+deb8u3	libssh-gcrypt-dev_0.6.3-4+deb8u3_armel.deb
Debian	8	i386	libssh-4	< 0.6.3-4+deb8u3	libssh-4_0.6.3-4+deb8u3_i386.deb
Debian	9	i386	libssh-gcrypt-dev	< 0.7.3-2+deb9u1	libssh-gcrypt-dev_0.7.3-2+deb9u1_i386.deb
Debian	9	ppc64el	libssh-gcrypt-4-dbgsym	< 0.7.3-2+deb9u1	libssh-gcrypt-4-dbgsym_0.7.3-2+deb9u1_ppc64el.deb
Debian	9	mips	libssh-gcrypt-dev	< 0.7.3-2+deb9u1	libssh-gcrypt-dev_0.7.3-2+deb9u1_mips.deb
Debian	9	amd64	libssh-4	< 0.7.3-2+deb9u1	libssh-4_0.7.3-2+deb9u1_amd64.deb
Debian	9	ppc64el	libssh-dev	< 0.7.3-2+deb9u1	libssh-dev_0.7.3-2+deb9u1_ppc64el.deb
Debian	8	i386	libssh-gcrypt-4	< 0.6.3-4+deb8u3	libssh-gcrypt-4_0.6.3-4+deb8u3_i386.deb