CVE-2018-10933

CVE-2018-10933 的 POC 在早于 0.7.6 和 0.8.4 版本的 libssh 服务器端状态机中发现了一个漏洞。恶意客户端无需首先进行身份验证即可创建通道，从而导致未经授权的访问。 用法 : python3 libssh.py -s SERVERADD -u USERNAME -c COMMMANDTOEXEC 原始公告详情: Peter Winter-Smith 发现，libssh 在用作服务器时错误地处理了身份验证。远程攻击者可以利用此问题在没有任何凭据的情况下绕过身份验证。 更新说明 可以通过将系统更新到以下软件包版本来纠正此问题： Ubuntu 18.10...

CVE-2018-10933

CVE-2018-10933 在libssh的服务器端状态机中（版本0.7.6和0.8.4之前）发现了一个漏洞。 恶意客户端可以在未首先进行身份验证的情况下创建通道，从而导致未授权访问。 一些细节 该问题源于libssh在认证过程中不维护状态，以及这种状态缺失如何被用来绕过认证。简而言之，将连接视为一个多步骤过程：步骤1、步骤2、步骤3……由于libssh不强制执行步骤的顺序，你基本上可以直接跳到步骤3，而不经过步骤1和步骤2。 有趣的是，之前在SSH库Paramiko中也发现了同样的问题：CVE-2018-7750。 文档 Exploit-DB :...

Rocky Linux 9.6 [TuxCare] Security Update: libssh / libssh-config / libssh-devel (ALMALINUX9.6:CLSA-2026:1778269628)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778269628 advisory. - A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory...

Rocky Linux 10.0 [CIQ] Security Update: libssh / libssh-config / libssh-debuginfo / libssh-debugsource / etc (crlsa-2025_18231)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202518231 advisory. libssh: out-of-bounds read in sftphandle CVE-2025-5318 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

Rocky Linux 9.6 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2025:1765985737)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1765985737 advisory. - A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting...

Rocky Linux 9.6 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2025:1764696522)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1764696522 advisory. - A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible...

Rocky Linux 8 [CIQ] Security Update: libssh / libssh-config / libssh-debuginfo / libssh-debugsource / etc Multiple Vulnerabilities (crlsa-2026_62218)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202662218 advisory. libssh: libssh: denial of service via zero advertised channel packet size CVE-2026-59843 libssh: libssh: denial of service via oversized SFTP read length...

Rocky Linux 9 [CIQ] Security Update: libssh / libssh-config / libssh-debuginfo / libssh-debugsource / etc (crlsa-2025_18275)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202518275 advisory. libssh: out-of-bounds read in sftphandle CVE-2025-5318 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

CentOS Linux 8 [TuxCare] Security Update: libssh / libssh-config / libssh-devel (CENTOS-STREAM8:CLSA-2026:1774007374)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1774007374 advisory. - A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftpextensionsgetname/sftpextensionsgetdata...

CentOS Linux 8.4 [TuxCare] Security Update: libssh / libssh-config / libssh-devel (CENTOS8.4:CLSA-2025:1759951300)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2025:1759951300 advisory. - A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible for key...

CentOS Linux 8.4 [TuxCare] Security Update: libssh / libssh-config / libssh-devel (CENTOS8.4:CLSA-2026:1776701249)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1776701249 advisory. - A flaw was found in libssh in which a malicious SFTP SSH File Transfer Protocol server can exploit this by sending a malformed 'longname'...

CentOS Linux 8 [TuxCare] Security Update: libssh / libssh-config / libssh-devel (CENTOS-STREAM8:CLSA-2026:1778003186)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1778003186 advisory. - A flaw was found in libssh. The API function sshgethexa is vulnerable to a denial of service when processing zero-length input. This ca...

AlmaLinux 9.6 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786549709)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786549709 advisory. - A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing lat...

Rocky Linux 9 [CIQ] Security Update: libssh / libssh-config / libssh-debuginfo / libssh-debugsource / etc Multiple Vulnerabilities (crlsa-2024_2504)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20242504 advisory. libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname CVE-2023-6004 libssh: Missing checks for return values for diges...

CentOS Linux 8.5 [TuxCare] Security Update: libssh / libssh-config / libssh-devel (CENTOS8.5:CLSA-2025:1759248061)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1759248061 advisory. - A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftphandle function due ...

Rocky Linux 8 [CIQ] Security Update: libssh / libssh-config / libssh-debuginfo / libssh-debugsource / etc Multiple Vulnerabilities (crlsa-2020_4545)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20204545 advisory. libssh: denial of service when handling AES-CTR or DES ciphers CVE-2020-1730 libssh: unsanitized location in scp could lead to unwanted command execution...

AlmaLinux 9.2 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786446507)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786446507 advisory. - A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing lat...

AlmaLinux 9.6 [TuxCare] Security Update: libssh / libssh-config / libssh-devel (ALMALINUX9.6:CLSA-2026:1776178207)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776178207 advisory. - A flaw was found in libssh in which a malicious SFTP SSH File Transfer Protocol server can exploit this by sending a malformed 'longname'...

Rocky Linux 8 [CIQ] Security Update: libssh / libssh-config / libssh-debuginfo / libssh-debugsource / etc (crlsa-2021_4387)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214387 advisory. libssh: NULL pointer dereference in sftpserver.c if sshbuffernew returns NULL CVE-2020-16135 Tenable has extracted the preceding description block directly from the...

CentOS Linux 8.4 [TuxCare] Security Update: libssh / libssh-config / libssh-devel (CENTOS8.4:CLSA-2026:1777939266)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1777939266 advisory. - A flaw was found in libssh. The API function sshgethexa is vulnerable to a denial of service when processing zero-length input. This can be...