[SECURITY] [DLA 1548-1] libssh security update

2018-10-1814:28:23

lists.debian.org

261

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.2 High

AI Score

Confidence

High

0.137 Low

EPSS

Percentile

95.7%

JSON

Package : libssh
Version : 0.6.3-4+deb8u3
CVE ID : CVE-2018-10933
Debian Bug : 911149

Peter Winter-Smith of NCC Group discovered that libssh, a tiny C SSH
library, contains an authentication bypass vulnerability in the server
code. An attacker can take advantage of this flaw to successfully
authenticate without any credentials by presenting the server an
SSH2_MSG_USERAUTH_SUCCESS message in place of the
SSH2_MSG_USERAUTH_REQUEST message which the server would expect to
initiate authentication.

For Debian 8 "Jessie", this problem has been fixed in version
0.6.3-4+deb8u3.

We recommend that you upgrade your libssh packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

–
Ben Hutchings - Debian developer, member of kernel, installer and LTS teams
Attachment:
signature.asc
Description: This is a digitally signed message part

OSVersionArchitecturePackageVersionFilename
Debian8amd64libssh-gcrypt-dev< 0.6.3-4+deb8u3libssh-gcrypt-dev_0.6.3-4+deb8u3_amd64.deb
Debian9ppc64ellibssh-dev< 0.7.3-2+deb9u1libssh-dev_0.7.3-2+deb9u1_ppc64el.deb
Debian9amd64libssh-dev< 0.7.3-2+deb9u1libssh-dev_0.7.3-2+deb9u1_amd64.deb
Debian9arm64libssh-gcrypt-4-dbgsym< 0.7.3-2+deb9u1libssh-gcrypt-4-dbgsym_0.7.3-2+deb9u1_arm64.deb
Debian9mipslibssh-gcrypt-4< 0.7.3-2+deb9u1libssh-gcrypt-4_0.7.3-2+deb9u1_mips.deb
Debian9arm64libssh-dev< 0.7.3-2+deb9u1libssh-dev_0.7.3-2+deb9u1_arm64.deb
Debian8amd64libssh-4< 0.6.3-4+deb8u3libssh-4_0.6.3-4+deb8u3_amd64.deb
Debian9armellibssh-4< 0.7.3-2+deb9u1libssh-4_0.7.3-2+deb9u1_armel.deb
Debian9s390xlibssh-4-dbgsym< 0.7.3-2+deb9u1libssh-4-dbgsym_0.7.3-2+deb9u1_s390x.deb
Debian8armhflibssh-gcrypt-dev< 0.6.3-4+deb8u3libssh-gcrypt-dev_0.6.3-4+deb8u3_armhf.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	amd64	libssh-gcrypt-dev	< 0.6.3-4+deb8u3	libssh-gcrypt-dev_0.6.3-4+deb8u3_amd64.deb
Debian	9	ppc64el	libssh-dev	< 0.7.3-2+deb9u1	libssh-dev_0.7.3-2+deb9u1_ppc64el.deb
Debian	9	amd64	libssh-dev	< 0.7.3-2+deb9u1	libssh-dev_0.7.3-2+deb9u1_amd64.deb
Debian	9	arm64	libssh-gcrypt-4-dbgsym	< 0.7.3-2+deb9u1	libssh-gcrypt-4-dbgsym_0.7.3-2+deb9u1_arm64.deb
Debian	9	mips	libssh-gcrypt-4	< 0.7.3-2+deb9u1	libssh-gcrypt-4_0.7.3-2+deb9u1_mips.deb
Debian	9	arm64	libssh-dev	< 0.7.3-2+deb9u1	libssh-dev_0.7.3-2+deb9u1_arm64.deb
Debian	8	amd64	libssh-4	< 0.6.3-4+deb8u3	libssh-4_0.6.3-4+deb8u3_amd64.deb
Debian	9	armel	libssh-4	< 0.7.3-2+deb9u1	libssh-4_0.7.3-2+deb9u1_armel.deb
Debian	9	s390x	libssh-4-dbgsym	< 0.7.3-2+deb9u1	libssh-4-dbgsym_0.7.3-2+deb9u1_s390x.deb
Debian	8	armhf	libssh-gcrypt-dev	< 0.6.3-4+deb8u3	libssh-gcrypt-dev_0.6.3-4+deb8u3_armhf.deb