rpm package
opensuse/libssh&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/libssh&distro=openSUSE%20Tumbleweed
Vulnerabilities (40)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-59850 | Med | 4.3 | < 0.11.5-1.2 | 0.11.5-1.2 | Jul 21, 2026 | A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions. | |
| CVE-2026-59849 | Low | 3.1 | < 0.11.5-1.2 | 0.11.5-1.2 | Jul 21, 2026 | A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service. | |
| CVE-2026-59848 | Med | 5.3 | < 0.11.5-1.2 | 0.11.5-1.2 | Jul 21, 2026 | A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service. | |
| CVE-2026-59847 | Med | 5.9 | < 0.11.5-1.2 | 0.11.5-1.2 | Jul 21, 2026 | A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection. | |
| CVE-2026-59846 | Low | 3.9 | < 0.11.5-1.2 | 0.11.5-1.2 | Jul 21, 2026 | A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior. | |
| CVE-2026-59845 | Med | 5.3 | < 0.11.5-1.2 | 0.11.5-1.2 | Jul 21, 2026 | A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service. | |
| CVE-2026-59844 | Med | 6.5 | < 0.11.5-1.2 | 0.11.5-1.2 | Jul 21, 2026 | A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests. | |
| CVE-2026-59843 | Med | 6.5 | < 0.11.5-1.2 | 0.11.5-1.2 | Jul 21, 2026 | A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service. | |
| CVE-2026-15370 | Med | 6.7 | < 0.11.5-1.2 | 0.11.5-1.2 | Jul 21, 2026 | A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buf | |
| CVE-2026-0968 | Low | 3.1 | < 0.11.4-1.1 | 0.11.4-1.1 | Mar 26, 2026 | A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory | |
| CVE-2026-0967 | Med | 5.5 | < 0.11.4-1.1 | 0.11.4-1.1 | Mar 26, 2026 | A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and | |
| CVE-2026-0966 | Hig | 8.2 | < 0.11.4-1.1 | 0.11.4-1.1 | Mar 26, 2026 | A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server' | |
| CVE-2026-0965 | Low | 3.3 | < 0.11.4-1.1 | 0.11.4-1.1 | Mar 26, 2026 | A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by c | |
| CVE-2026-0964 | Med | 6.3 | < 0.11.4-1.1 | 0.11.4-1.1 | Mar 26, 2026 | A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This | |
| CVE-2025-8277 | Low | 3.1 | < 0.11.3-1.1 | 0.11.3-1.1 | Sep 9, 2025 | A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side | |
| CVE-2025-4877 | Med | 4.5 | < 0.11.2-1.1 | 0.11.2-1.1 | Aug 20, 2025 | There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can experience an integer overflow leading to a memory under allocation, when | |
| CVE-2025-5449 | Med | 6.5 | < 0.11.2-1.1 | 0.11.2-1.1 | Jul 25, 2025 | A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server p | |
| CVE-2025-8114 | Med | 4.7 | < 0.11.3-1.1 | 0.11.3-1.1 | Jul 24, 2025 | A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to cra | |
| CVE-2025-4878 | Low | 3.6 | < 0.11.2-1.1 | 0.11.2-1.1 | Jul 22, 2025 | A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption | |
| CVE-2025-5987 | Hig | 8.1 | < 0.11.2-1.1 | 0.11.2-1.1 | Jul 7, 2025 | A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returne |
- affected < 0.11.5-1.2fixed 0.11.5-1.2
A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.
- affected < 0.11.5-1.2fixed 0.11.5-1.2
A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.
- affected < 0.11.5-1.2fixed 0.11.5-1.2
A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.
- affected < 0.11.5-1.2fixed 0.11.5-1.2
A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.
- affected < 0.11.5-1.2fixed 0.11.5-1.2
A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.
- affected < 0.11.5-1.2fixed 0.11.5-1.2
A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.
- affected < 0.11.5-1.2fixed 0.11.5-1.2
A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.
- affected < 0.11.5-1.2fixed 0.11.5-1.2
A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.
- affected < 0.11.5-1.2fixed 0.11.5-1.2
A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buf
- affected < 0.11.4-1.1fixed 0.11.4-1.1
A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory
- affected < 0.11.4-1.1fixed 0.11.4-1.1
A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and
- affected < 0.11.4-1.1fixed 0.11.4-1.1
A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server'
- affected < 0.11.4-1.1fixed 0.11.4-1.1
A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by c
- affected < 0.11.4-1.1fixed 0.11.4-1.1
A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This
- affected < 0.11.3-1.1fixed 0.11.3-1.1
A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side
- affected < 0.11.2-1.1fixed 0.11.2-1.1
There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can experience an integer overflow leading to a memory under allocation, when
- affected < 0.11.2-1.1fixed 0.11.2-1.1
A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server p
- affected < 0.11.3-1.1fixed 0.11.3-1.1
A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to cra
- affected < 0.11.2-1.1fixed 0.11.2-1.1
A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption
- affected < 0.11.2-1.1fixed 0.11.2-1.1
A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returne
Page 1 of 2