Veracode Vulnerability DatabaseVERACODE:40622Denial Of Services (DoS)
EPSS
Percentile
46.2%
libssh.so is vulnerable to Denial Of Services (DoS). The vulnerability exists due to a null pointer dereference during rekeying with algorithm guessing, which allows an attacker to cause an application crash when the client initiates rekeying with the first_kex_packet_follows flag in the KEXINIT message.
References
www.libssh.org/security/advisories/CVE-2023-1667.txt
access.redhat.com/security/cve/CVE-2023-1667
bugzilla.redhat.com/show_bug.cgi?id=2182199
bugzilla.suse.com/show_bug.cgi?id=1211188
git.libssh.org/projects/libssh.git/commit/?id=08386d4787f8f532ae289b2a49211486a6af48a9
git.libssh.org/projects/libssh.git/commit/?id=8dbe055328ca8cd33d798d647ed423ae8cba0b90
lists.debian.org/debian-lts-announce/2023/05/msg00029.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27PD44ALQTZXX7K6JAM3BXBUHYA6DFFN/
lists.fedoraproject.org/archives/list/[email protected]/message/27PD44ALQTZXX7K6JAM3BXBUHYA6DFFN/
security.gentoo.org/glsa/202312-05
www.libssh.org/2023/05/04/libssh-0-10-5-and-libssh-0-9-7-security-releases/
www.libssh.org/security/advisories/CVE-2023-1667.txt
Related
