Authorization Bypass

🗓️ 21 May 2023 11:53:42Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 47 Views

Authorization Bypass in libssh.so due to pki_crypto.c vulnerability

Reporter	Title	Published	Views	Family All 156
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues	30 Nov 202318:45	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Linux kernel, libssh, and Java can affect IBM Spectrum Protect Plus	22 Aug 202314:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to libssh security bypass vulnerabilitiy [ CVE-2023-2283]	31 Jan 202413:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service and security restriction bypass due to [CVE-2023-2283], [CVE-2023-1667]	27 Jul 202315:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Linux components affect IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products	19 Jun 202417:53	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOps	26 Mar 202503:58	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in libssh affect IBM SAN Volume Controller, IBM Spectrum Virtualize and IBM FlashSystem products	30 Jun 202513:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from openssl-libs, libssh, libarchive, sqlite and go-toolset	1 Aug 202306:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple CVEs may affect Operating System packages shipped with IBM CICS TX Advanced 10.1	4 Sep 202311:15	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in libssh library (CVE-2023-1667, CVE-2023-2283 ) affect Power HMC	16 Apr 202416:54	–	ibm

Vulners

Node

libssh.so libssh.soRange4.8.1–4.8.7cpp

libssh.so libssh.soRange4.9.0–4.9.4cpp

libssh libsshMatch0.7.1_0.7.el7

libssh libsshMatch0.7.7_1.el7

libssh libsshMatch0.9.0_4.el8

libssh libsshMatch0.7.1_3.el7

libssh libsshMatch0.7.1_7.el7

libssh libsshMatch0.9.4_2.el8

libssh libsshMatch0.8.5_2.el8

libssh libsshMatch0.9.4_3.el8

libssh libsshMatch0.7.1_2.el7

libssh libsshMatch0.9.4_1.el8

libssh libsshMatch0.9.6_3.el8

libssh2 libssh2Match1.2.2_7.el6_2.3

libssh2 libssh2Match1.4.2_2.el6_7.1

libssh2 libssh2Match1.4.3_12.el7_6.2

libssh2 libssh2Match1.4.2_3.el6_10.1

libssh2 libssh2Match1.4.2_1.el6

libssh2 libssh2Match1.2.2_7.el6_1.1

libssh2 libssh2Match1.8.0_4.el7

libssh2 libssh2Match1.4.3_12.el7

libssh2 libssh2Match1.2.2_7.el6

libssh2 libssh2Match1.8.0_3.el7

libssh2 libssh2Match1.4.3_12.el7_6.3

libssh2 libssh2Match1.4.2_1.el6_6.1

libssh2 libssh2Match1.2.2_11.el6_3

Source	Link
git	www.git.libssh.org/projects/libssh.git/commit/
bugzilla	www.bugzilla.suse.com/show_bug.cgi
git	www.git.libssh.org/projects/libssh.git/commit/
libssh	www.libssh.org/security/advisories/CVE-2023-2283.txt
libssh	www.libssh.org/2023/05/04/libssh-0-10-5-and-libssh-0-9-7-security-releases/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27PD44ALQTZXX7K6JAM3BXBUHYA6DFFN/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/27PD44ALQTZXX7K6JAM3BXBUHYA6DFFN/
security	www.security.gentoo.org/glsa/202312-05
packetstormsecurity	www.packetstormsecurity.com/files/172861/libssh-0.9.6-0.10.4-pki_verify_data_signature-Authorization-Bypass.html
access	www.access.redhat.com/security/cve/CVE-2023-2283

01 Feb 2024 23:07Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.16.5

EPSS0.0019