Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ubuntuUbuntuUSN-6585-1
HistoryJan 15, 2024 - 12:00 a.m.

libssh2 vulnerability

2024-01-1500:00:00
ubuntu.com
22
ubuntu
libssh2
vulnerability
terrapin attack
protocol extensions

6.6 Medium

AI Score

Confidence

High

0.962 High

EPSS

Percentile

99.5%

JSON

Releases

  • Ubuntu 23.10

Packages

  • libssh2 - Client-side C library implementing the SSH2 protocol

Details

Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH
protocol was vulnerable to a prefix truncation attack. If a remote attacker
was able to intercept SSH communications, extension negotiation messages
could be truncated, possibly leading to certain algorithms and features
being downgraded. This issue is known as the Terrapin attack. This update
adds protocol extensions to mitigate this issue.

OSVersionArchitecturePackageVersionFilename
Ubuntu23.10noarchlibssh2-1< 1.11.0-2ubuntu0.1UNKNOWN
Ubuntu23.10noarchlibssh2-1-dbgsym< 1.11.0-2ubuntu0.1UNKNOWN
Ubuntu23.10noarchlibssh2-1-dev< 1.11.0-2ubuntu0.1UNKNOWN

Related

nessus 73
cbl_mariner 8
redos 2
openvas 48
atlassian 1
osv 14
freebsd 3
ubuntu 3
oraclelinux 5
mageia 6
redhat 4
debian 4
cloudfoundry 1
alpinelinux 1
fedora 9
ubuntucve 1
github 1
ibm 5
almalinux 1
amazon 2
thn 1
freebsd_advisory 1
debiancve 1
cgr 1
f5 1
paloalto 1
veracode 1
nessus
nessus
openSUSE 15 Security Update : proftpd (openSUSE-SU-2023:0421-1)
2023-12-30 00:00:00
Fedora 38 : python-paramiko (2024-39a8c72ea9)
2024-01-10 00:00:00
EulerOS Virtualization 2.10.1 : libssh2 (EulerOS-SA-2024-1548)
2024-04-19 00:00:00
cbl_mariner
cbl_mariner
CVE-2023-48795 affecting package kubevirt for versions less than null
2024-01-10 08:19:37
CVE-2023-48795 affecting package libssh for versions less than 0.10.6-1
2024-01-14 22:46:30
CVE-2023-48795 affecting package moby-cli for versions less than 20.10.27-2
2024-01-19 03:54:24
redos
redos
ROS-20240408-15
2024-04-08 00:00:00
ROS-20240409-04
2024-04-09 00:00:00
openvas
openvas
Fedora: Security Advisory for golang-x-crypto (FEDORA-2024-7b08207cdb)
2024-01-18 00:00:00
Fedora: Security Advisory for proftpd (FEDORA-2023-b87ec6cf47)
2023-12-30 00:00:00
Huawei EulerOS: Security Advisory for libssh2 (EulerOS-SA-2024-1217)
2024-03-12 00:00:00
atlassian
atlassian
CVE-2023-48795 vulnerability on SSH
2024-01-04 17:19:13
osv
osv
libssh vulnerability
2023-12-19 13:08:22
php-phpseclib3 - security update
2024-01-12 00:00:00
Man-in-the-middle attacker can compromise integrity of secure channel in golang.org/x/crypto
2023-12-18 21:18:26
freebsd
freebsd
jenkins -- Terrapin SSH vulnerability in Jenkins CLI client
2024-04-17 00:00:00
FreeBSD -- Prefix Truncation Attack in the SSH protocol
2023-12-19 00:00:00
putty -- add protocol extension against 'Terrapin attack'
2023-10-16 00:00:00
ubuntu
ubuntu
LXD vulnerability
2024-04-22 00:00:00
FileZilla vulnerability
2024-01-18 00:00:00
Paramiko vulnerability
2024-01-25 00:00:00
oraclelinux
oraclelinux
buildah security update
2024-03-07 00:00:00
openssh security update
2024-03-18 00:00:00
openssh security update
2024-03-19 00:00:00
mageia
mageia
Updated erlang packages fix a security vulnerability (Terrapin Attack)
2024-01-20 01:43:32
Updated putty package fixes a security vulnerability (Terrapin attack)
2024-01-08 13:12:44
Updated dropbear package fixes a security vulnerability
2024-01-08 22:01:05
redhat
redhat
(RHSA-2024:1196) Moderate: Red Hat JBoss Enterprise Application Platform 7.4 security update
2024-03-06 17:50:02
(RHSA-2024:1150) Moderate: buildah security update
2024-03-05 15:32:31
(RHSA-2024:0625) Moderate: libssh security update
2024-01-31 08:08:23
debian
debian
[SECURITY] [DSA 5600-1] php-phpseclib security update
2024-01-12 07:13:37
[SECURITY] [DLA 3718-1] php-phpseclib security update
2024-01-25 02:26:31
[SECURITY] [DLA 3730-1] python-asyncssh security update
2024-02-01 00:22:40
cloudfoundry
cloudfoundry
USN-6561-1: libssh vulnerability | Cloud Foundry
2024-04-04 00:00:00
alpinelinux
alpinelinux
CVE-2023-48795
2023-12-18 16:15:10
fedora
fedora
[SECURITY] Fedora 39 Update: putty-0.80-1.fc39
2024-01-11 01:17:14
[SECURITY] Fedora 39 Update: prometheus-podman-exporter-1.7.0-1.fc39
2024-01-29 06:26:11
[SECURITY] Fedora 39 Update: podman-4.8.3-1.fc39
2024-01-09 01:46:45
ubuntucve
ubuntucve
CVE-2023-48795
2023-12-18 00:00:00
github
github
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin
2023-12-18 19:22:09
ibm
ibm
Security Bulletin: OpenSSH vulnerability affects IBM WebSphere Adapter for FTP shipped with IBM Business Automation Workflow - CVE-2023-48795
2024-03-22 16:29:44
Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to a machine-in-the-middle attack due to Apache MINA SSHD (CVE-2023-48795)
2024-04-04 17:46:46
Security Bulletin: IBM App Connect Enterprise is vulnerable to a machine-in-the-middle attack due to OpenSSH (CVE-2023-48795)
2024-04-22 15:23:07
almalinux
almalinux
Moderate: libssh security update
2024-01-31 00:00:00
amazon
amazon
Medium: openssh
2023-12-18 09:20:00
Medium: openssh
2023-12-18 09:20:00
thn
thn
New Terrapin Flaw Could Let Attackers Downgrade SSH Protocol Security
2024-01-01 09:37:00
freebsd_advisory
freebsd_advisory
FreeBSD-SA-23:19.openssh
2023-12-19 00:00:00
debiancve
debiancve
CVE-2023-48795
2023-12-18 16:15:10
cgr
cgr
CVE-2023-48795 vulnerabilities
2024-05-19 03:07:16
f5
f5
K000138264 : SSH vulnerability CVE-2023-48795
2024-01-17 00:00:00
paloalto
paloalto
Impact of Terrapin SSH Attack
2024-01-09 01:30:00
veracode
veracode
Rogue Session Attack (Terrapin)
2023-12-19 06:46:15

6.6 Medium

AI Score

Confidence

High

0.962 High

EPSS

Percentile

99.5%

JSON
Related for USN-6585-1
nessus73cbl_mariner8redos2openvas48atlassian1osv14freebsd3ubuntu3oraclelinux5mageia6redhat4debian4cloudfoundry1alpinelinux1fedora9ubuntucve1github1ibm5almalinux1amazon2thn1freebsd_advisory1debiancve1cgr1f51paloalto1veracode1