CVE-2016-0787

The CVE-2016-0787 entry concerns libssh2 (before 1.7.0) where the diffie_hellman_sha256 function truncates ephemeral DH secrets to 128 or 256 bits, enabling potential man-in-the-middle decryption/interception of SSH sessions. Root cause: truncated DH secret length. Impact: weakened SSH handshake ...

CVE-2016-0787

The diffiehellmansha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."...

CVE-2016-0787: Exposure of Sensitive Information to an Unauthorized Actor

The diffiehellmansha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."...

Amazon Linux AMI : libssh2 (ALAS-2016-683)

A type confusion issue was found in the way libssh2 generated ephemeral secrets for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This would cause an SSHv2 Diffie-Hellman handshake to use significantly less secure random parameters. C Tenable Network Security, Inc. Th...

Medium: libssh2

Issue Overview: A type confusion issue was found in the way libssh2 generated ephemeral secrets for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This would cause an SSHv2 Diffie-Hellman handshake to use significantly less secure random parameters. Affected Packages:...

libssh2 Security Bypass Vulnerability

libssh2 is a client-side C library for implementing the SSH2 protocol. A security vulnerability exists in libssh2 that allows remote attackers to exploit vulnerabilities and cause the SSHv2 Diffie-Hellman handshake to use insecure random parameters...

CentOS Update for libssh2 CESA-2016:0428 centos6

Check the version of libssh2 SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882417";...

Scientific Linux Security Update : libssh2 on SL6.x, SL7.x i386/x86_64 (20160310)

A type confusion issue was found in the way libssh2 generated ephemeral secrets for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This would cause an SSHv2 Diffie-Hellman handshake to use significantly less secure random parameters. CVE-2016-0787 After installing thes...

Oracle Linux 6 / 7 : libssh2 (ELSA-2016-0428)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-0428 advisory. - use secrects of the appropriate length in Diffie-Hellman CVE-2016-0787 Tenable has extracted the preceding description block directly from the Oracle Linu...

Oracle: Security Advisory (ELSA-2016-0428)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RedHat Update for libssh2 RHSA-2016:0428-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS 6 / 7 : libssh2 (CESA-2016:0428)

Updated libssh2 packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

OracleVM 3.3 / 3.4 : libssh2 (OVMSA-2016-0035)

The remote OracleVM system is missing necessary patches to address critical security updates : - use secrects of the appropriate length in Diffie-Hellman CVE-2016-0787 - fix basic functionality of libssh2 in FIPS mode 968575 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks ...

CentOS Update for libssh2 CESA-2016:0428 centos7

Check the version of libssh2 SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882419";...

libssh2 security update

CentOS Errata and Security Advisory CESA-2016:0428 Updated libssh2 packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score,...

libssh2: bits/bytes confusion resulting in truncated Diffie-Hellman secret length

A type confusion issue was found in the way libssh2 generated ephemeral secrets for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This would cause an SSHv2 Diffie-Hellman handshake to use significantly less secure random parameters...

Moderate: Red Hat Security Advisory: libssh2 security update

Updated libssh2 packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

Fedora Update for libssh2 FEDORA-2016-7942

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

libssh2 security update

1.4.2-2.el67.1 - use secrects of the appropriate length in Diffie-Hellman CVE-2016-0787 1.4.2-2 - fix basic functionality of libssh2 in FIPS mode 968575...

RHEL 6 / 7 : libssh2 (RHSA-2016:0428)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:0428 advisory. The libssh2 packages provide a library that implements the SSHv2 protocol. A type confusion issue was found in the way libssh2 generated ephemera...