rpm package
almalinux/libssh-devel
pkg:rpm/almalinux/libssh-devel
Vulnerabilities (31)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-5987 | Hig | 8.1 | < 0.10.4-17.el9_7 | 0.10.4-17.el9_7 | Jul 7, 2025 | A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returne | |
| CVE-2025-5351 | Med | 6.5 | < 0.10.4-18.el9 | 0.10.4-18.el9 | Jul 4, 2025 | A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issu | |
| CVE-2025-5372 | Med | 5.0 | < 0.9.6-16.el8_10 | 0.9.6-16.el8_10 | Jul 4, 2025 | A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the fu | |
| CVE-2025-5318 | Med | 5.4 | < 0.10.4-15.el9_6 | 0.10.4-15.el9_6 | Jun 24, 2025 | A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, w | |
| CVE-2023-6004 | Med | 4.8 | < 0.10.4-13.el9 | 0.10.4-13.el9 | Jan 3, 2024 | A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter. | |
| CVE-2023-6918 | Low | 3.7 | < 0.10.4-13.el9 | 0.10.4-13.el9 | Dec 19, 2023 | A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or | |
| CVE-2023-48795 | Med | 5.9 | < 0.9.6-13.el8_9 | 0.9.6-13.el8_9 | Dec 18, 2023 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end | |
| CVE-2023-2283 | Med | 6.5 | < 0.9.6-10.el8_8 | 0.9.6-10.el8_8 | May 26, 2023 | A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem | |
| CVE-2023-1667 | Med | 6.5 | < 0.9.6-10.el8_8 | 0.9.6-10.el8_8 | May 26, 2023 | A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service. | |
| CVE-2021-3634 | Med | 6.5 | < 0.9.6-3.el8 | 0.9.6-3.el8 | Aug 31, 2021 | A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other session_id. Initially, both of them are the same, but after key re-exchange, previous | |
| CVE-2020-16135 | Med | 5.9 | < 0.9.4-3.el8 | 0.9.4-3.el8 | Jul 29, 2020 | libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL. |
- affected < 0.10.4-17.el9_7fixed 0.10.4-17.el9_7
A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returne
- affected < 0.10.4-18.el9fixed 0.10.4-18.el9
A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issu
- affected < 0.9.6-16.el8_10fixed 0.9.6-16.el8_10
A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the fu
- affected < 0.10.4-15.el9_6fixed 0.10.4-15.el9_6
A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, w
- affected < 0.10.4-13.el9fixed 0.10.4-13.el9
A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.
- affected < 0.10.4-13.el9fixed 0.10.4-13.el9
A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or
- affected < 0.9.6-13.el8_9fixed 0.9.6-13.el8_9
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end
- affected < 0.9.6-10.el8_8fixed 0.9.6-10.el8_8
A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem
- affected < 0.9.6-10.el8_8fixed 0.9.6-10.el8_8
A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.
- affected < 0.9.6-3.el8fixed 0.9.6-3.el8
A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other session_id. Initially, both of them are the same, but after key re-exchange, previous
- affected < 0.9.4-3.el8fixed 0.9.4-3.el8
libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
Page 2 of 2