Action not permitted
Modal body text goes here.
cve-2023-6918
Vulnerability from cvelistv5
Published
2023-12-18 23:27
Modified
2024-09-16 17:53
Severity ?
EPSS score ?
Summary
Libssh: missing checks for return values for digests
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T08:42:08.414Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "RHSA-2024:2504", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:2504" }, { "name": "RHSA-2024:3233", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:3233" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/security/cve/CVE-2023-6918" }, { "name": "RHBZ#2254997", "tags": [ "issue-tracking", "x_refsource_REDHAT", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254997" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/" }, { "tags": [ "x_transferred" ], "url": "https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/" }, { "tags": [ "x_transferred" ], "url": "https://www.libssh.org/security/advisories/CVE-2023-6918.txt" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/o:redhat:enterprise_linux:8::baseos" ], "defaultStatus": "affected", "packageName": "libssh", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:0.9.6-14.el8", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/o:redhat:enterprise_linux:8::baseos" ], "defaultStatus": "affected", "packageName": "libssh", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:0.9.6-14.el8", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos" ], "defaultStatus": "affected", "packageName": "libssh", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:0.10.4-13.el9", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos" ], "defaultStatus": "affected", "packageName": "libssh", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:0.10.4-13.el9", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:6" ], "defaultStatus": "unknown", "packageName": "libssh2", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ], "defaultStatus": "unknown", "packageName": "libssh", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ], "defaultStatus": "unknown", "packageName": "libssh2", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat" } ], "credits": [ { "lang": "en", "value": "Red Hat would like to thank Jack Weinstein (\u003cmike.code.bb.h@gmail.com\u003e) for reporting this issue." } ], "datePublic": "2023-12-18T00:00:00+00:00", "descriptions": [ { "lang": "en", "value": "A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Low" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-252", "description": "Unchecked Return Value", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-09-16T17:53:33.499Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "RHSA-2024:2504", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:2504" }, { "name": "RHSA-2024:3233", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:3233" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2023-6918" }, { "name": "RHBZ#2254997", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254997" }, { "url": "https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/" }, { "url": "https://www.libssh.org/security/advisories/CVE-2023-6918.txt" } ], "timeline": [ { "lang": "en", "time": "2023-12-18T00:00:00+00:00", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2023-12-18T00:00:00+00:00", "value": "Made public." } ], "title": "Libssh: missing checks for return values for digests", "workarounds": [ { "lang": "en", "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability." } ], "x_redhatCweChain": "CWE-252: Unchecked Return Value" } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2023-6918", "datePublished": "2023-12-18T23:27:48.540Z", "dateReserved": "2023-12-18T11:40:15.080Z", "dateUpdated": "2024-09-16T17:53:33.499Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2023-6918\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2023-12-19T00:15:08.460\",\"lastModified\":\"2024-09-16T18:15:53.620\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.\"},{\"lang\":\"es\",\"value\":\"Se encontr\u00f3 un fallo en la capa abstracta de implementaci\u00f3n de libssh para operaciones de resumen de mensajes (MD) implementadas por diferentes backends criptogr\u00e1ficos compatibles. Los valores de retorno de estos no se verificaron correctamente, lo que podr\u00eda causar fallas en situaciones de poca memoria, desreferencias NULL, fallas o uso de la memoria no inicializada como entrada para el KDF. En este caso, las claves que no coinciden resultar\u00e1n en fallas de descifrado/integridad, lo que terminar\u00e1 la conexi\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4},{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\",\"baseScore\":3.7,\"baseSeverity\":\"LOW\"},\"exploitabilityScore\":2.2,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-252\"}]},{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-252\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.9.0\",\"versionEndExcluding\":\"0.9.8\",\"matchCriteriaId\":\"4836788D-9936-404F-B0A8-DDDAC3969F20\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.10.0\",\"versionEndExcluding\":\"0.10.6\",\"matchCriteriaId\":\"BCB546AC-788C-422E-B6BD-756BF39BD0F5\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC559B26-5DFC-4B7A-A27C-B77DE755DFF9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4CFF558-3C47-480D-A2F0-BABF26042943\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F6FB57C-2BC7-487C-96DD-132683AEB35D\"}]}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2024:2504\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:3233\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2023-6918\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2254997\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://www.libssh.org/security/advisories/CVE-2023-6918.txt\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]}]}}" } }
rhsa-2024_2504
Vulnerability from csaf_redhat
Published
2024-04-30 10:22
Modified
2024-11-06 05:42
Summary
Red Hat Security Advisory: libssh security update
Notes
Topic
An update for libssh is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.
Security Fix(es):
* libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname (CVE-2023-6004)
* libssh: Missing checks for return values for digests (CVE-2023-6918)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Low" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for libssh is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname (CVE-2023-6004)\n\n* libssh: Missing checks for return values for digests (CVE-2023-6918)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2024:2504", "url": "https://access.redhat.com/errata/RHSA-2024:2504" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#low", "url": "https://access.redhat.com/security/updates/classification/#low" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index" }, { "category": "external", "summary": "2251110", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251110" }, { "category": "external", "summary": "2254997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254997" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2504.json" } ], "title": "Red Hat Security Advisory: libssh security update", "tracking": { "current_release_date": "2024-11-06T05:42:47+00:00", "generator": { "date": "2024-11-06T05:42:47+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2024:2504", "initial_release_date": "2024-04-30T10:22:20+00:00", "revision_history": [ { "date": "2024-04-30T10:22:20+00:00", "number": "1", "summary": "Initial version" }, { "date": "2024-04-30T10:22:20+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T05:42:47+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux BaseOS (v. 9)", "product": { "name": "Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:9::baseos" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "libssh-devel-0:0.10.4-13.el9.aarch64", "product": { "name": "libssh-devel-0:0.10.4-13.el9.aarch64", "product_id": "libssh-devel-0:0.10.4-13.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-devel@0.10.4-13.el9?arch=aarch64" } } }, { "category": "product_version", "name": "libssh-debugsource-0:0.10.4-13.el9.aarch64", "product": { "name": "libssh-debugsource-0:0.10.4-13.el9.aarch64", "product_id": "libssh-debugsource-0:0.10.4-13.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debugsource@0.10.4-13.el9?arch=aarch64" } } }, { "category": "product_version", "name": "libssh-debuginfo-0:0.10.4-13.el9.aarch64", "product": { "name": "libssh-debuginfo-0:0.10.4-13.el9.aarch64", "product_id": "libssh-debuginfo-0:0.10.4-13.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debuginfo@0.10.4-13.el9?arch=aarch64" } } }, { "category": "product_version", "name": "libssh-0:0.10.4-13.el9.aarch64", "product": { "name": "libssh-0:0.10.4-13.el9.aarch64", "product_id": "libssh-0:0.10.4-13.el9.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh@0.10.4-13.el9?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "libssh-devel-0:0.10.4-13.el9.ppc64le", "product": { "name": "libssh-devel-0:0.10.4-13.el9.ppc64le", "product_id": "libssh-devel-0:0.10.4-13.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-devel@0.10.4-13.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "libssh-debugsource-0:0.10.4-13.el9.ppc64le", "product": { "name": "libssh-debugsource-0:0.10.4-13.el9.ppc64le", "product_id": "libssh-debugsource-0:0.10.4-13.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debugsource@0.10.4-13.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "product": { "name": "libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "product_id": "libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debuginfo@0.10.4-13.el9?arch=ppc64le" } } }, { "category": "product_version", "name": "libssh-0:0.10.4-13.el9.ppc64le", "product": { "name": "libssh-0:0.10.4-13.el9.ppc64le", "product_id": "libssh-0:0.10.4-13.el9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh@0.10.4-13.el9?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "libssh-devel-0:0.10.4-13.el9.i686", "product": { "name": "libssh-devel-0:0.10.4-13.el9.i686", "product_id": "libssh-devel-0:0.10.4-13.el9.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-devel@0.10.4-13.el9?arch=i686" } } }, { "category": "product_version", "name": "libssh-debugsource-0:0.10.4-13.el9.i686", "product": { "name": "libssh-debugsource-0:0.10.4-13.el9.i686", "product_id": "libssh-debugsource-0:0.10.4-13.el9.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debugsource@0.10.4-13.el9?arch=i686" } } }, { "category": "product_version", "name": "libssh-debuginfo-0:0.10.4-13.el9.i686", "product": { "name": "libssh-debuginfo-0:0.10.4-13.el9.i686", "product_id": "libssh-debuginfo-0:0.10.4-13.el9.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debuginfo@0.10.4-13.el9?arch=i686" } } }, { "category": "product_version", "name": "libssh-0:0.10.4-13.el9.i686", "product": { "name": "libssh-0:0.10.4-13.el9.i686", "product_id": "libssh-0:0.10.4-13.el9.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh@0.10.4-13.el9?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "libssh-devel-0:0.10.4-13.el9.x86_64", "product": { "name": "libssh-devel-0:0.10.4-13.el9.x86_64", "product_id": "libssh-devel-0:0.10.4-13.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-devel@0.10.4-13.el9?arch=x86_64" } } }, { "category": "product_version", "name": "libssh-debugsource-0:0.10.4-13.el9.x86_64", "product": { "name": "libssh-debugsource-0:0.10.4-13.el9.x86_64", "product_id": "libssh-debugsource-0:0.10.4-13.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debugsource@0.10.4-13.el9?arch=x86_64" } } }, { "category": "product_version", "name": "libssh-debuginfo-0:0.10.4-13.el9.x86_64", "product": { "name": "libssh-debuginfo-0:0.10.4-13.el9.x86_64", "product_id": "libssh-debuginfo-0:0.10.4-13.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debuginfo@0.10.4-13.el9?arch=x86_64" } } }, { "category": "product_version", "name": "libssh-0:0.10.4-13.el9.x86_64", "product": { "name": "libssh-0:0.10.4-13.el9.x86_64", "product_id": "libssh-0:0.10.4-13.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh@0.10.4-13.el9?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "libssh-devel-0:0.10.4-13.el9.s390x", "product": { "name": "libssh-devel-0:0.10.4-13.el9.s390x", "product_id": "libssh-devel-0:0.10.4-13.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-devel@0.10.4-13.el9?arch=s390x" } } }, { "category": "product_version", "name": "libssh-debugsource-0:0.10.4-13.el9.s390x", "product": { "name": "libssh-debugsource-0:0.10.4-13.el9.s390x", "product_id": "libssh-debugsource-0:0.10.4-13.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debugsource@0.10.4-13.el9?arch=s390x" } } }, { "category": "product_version", "name": "libssh-debuginfo-0:0.10.4-13.el9.s390x", "product": { "name": "libssh-debuginfo-0:0.10.4-13.el9.s390x", "product_id": "libssh-debuginfo-0:0.10.4-13.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debuginfo@0.10.4-13.el9?arch=s390x" } } }, { "category": "product_version", "name": "libssh-0:0.10.4-13.el9.s390x", "product": { "name": "libssh-0:0.10.4-13.el9.s390x", "product_id": "libssh-0:0.10.4-13.el9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh@0.10.4-13.el9?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "libssh-0:0.10.4-13.el9.src", "product": { "name": "libssh-0:0.10.4-13.el9.src", "product_id": "libssh-0:0.10.4-13.el9.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh@0.10.4-13.el9?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "libssh-config-0:0.10.4-13.el9.noarch", "product": { "name": "libssh-config-0:0.10.4-13.el9.noarch", "product_id": "libssh-config-0:0.10.4-13.el9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-config@0.10.4-13.el9?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.10.4-13.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.aarch64" }, "product_reference": "libssh-0:0.10.4-13.el9.aarch64", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.10.4-13.el9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.i686" }, "product_reference": "libssh-0:0.10.4-13.el9.i686", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.10.4-13.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.ppc64le" }, "product_reference": "libssh-0:0.10.4-13.el9.ppc64le", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.10.4-13.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.s390x" }, "product_reference": "libssh-0:0.10.4-13.el9.s390x", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.10.4-13.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.src" }, "product_reference": "libssh-0:0.10.4-13.el9.src", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.10.4-13.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.x86_64" }, "product_reference": "libssh-0:0.10.4-13.el9.x86_64", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-config-0:0.10.4-13.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-config-0:0.10.4-13.el9.noarch" }, "product_reference": "libssh-config-0:0.10.4-13.el9.noarch", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.10.4-13.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.aarch64" }, "product_reference": "libssh-debuginfo-0:0.10.4-13.el9.aarch64", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.10.4-13.el9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.i686" }, "product_reference": "libssh-debuginfo-0:0.10.4-13.el9.i686", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.10.4-13.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.ppc64le" }, "product_reference": "libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.10.4-13.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.s390x" }, "product_reference": "libssh-debuginfo-0:0.10.4-13.el9.s390x", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.10.4-13.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.x86_64" }, "product_reference": "libssh-debuginfo-0:0.10.4-13.el9.x86_64", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.10.4-13.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.aarch64" }, "product_reference": "libssh-debugsource-0:0.10.4-13.el9.aarch64", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.10.4-13.el9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.i686" }, "product_reference": "libssh-debugsource-0:0.10.4-13.el9.i686", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.10.4-13.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.ppc64le" }, "product_reference": "libssh-debugsource-0:0.10.4-13.el9.ppc64le", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.10.4-13.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.s390x" }, "product_reference": "libssh-debugsource-0:0.10.4-13.el9.s390x", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.10.4-13.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.x86_64" }, "product_reference": "libssh-debugsource-0:0.10.4-13.el9.x86_64", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.10.4-13.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.aarch64" }, "product_reference": "libssh-devel-0:0.10.4-13.el9.aarch64", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.10.4-13.el9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.i686" }, "product_reference": "libssh-devel-0:0.10.4-13.el9.i686", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.10.4-13.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.ppc64le" }, "product_reference": "libssh-devel-0:0.10.4-13.el9.ppc64le", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.10.4-13.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.s390x" }, "product_reference": "libssh-devel-0:0.10.4-13.el9.s390x", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.10.4-13.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.x86_64" }, "product_reference": "libssh-devel-0:0.10.4-13.el9.x86_64", "relates_to_product_reference": "AppStream-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.10.4-13.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.aarch64" }, "product_reference": "libssh-0:0.10.4-13.el9.aarch64", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.10.4-13.el9.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.i686" }, "product_reference": "libssh-0:0.10.4-13.el9.i686", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.10.4-13.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.ppc64le" }, "product_reference": "libssh-0:0.10.4-13.el9.ppc64le", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.10.4-13.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.s390x" }, "product_reference": "libssh-0:0.10.4-13.el9.s390x", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.10.4-13.el9.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.src" }, "product_reference": "libssh-0:0.10.4-13.el9.src", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.10.4-13.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.x86_64" }, "product_reference": "libssh-0:0.10.4-13.el9.x86_64", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-config-0:0.10.4-13.el9.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-config-0:0.10.4-13.el9.noarch" }, "product_reference": "libssh-config-0:0.10.4-13.el9.noarch", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.10.4-13.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.aarch64" }, "product_reference": "libssh-debuginfo-0:0.10.4-13.el9.aarch64", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.10.4-13.el9.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.i686" }, "product_reference": "libssh-debuginfo-0:0.10.4-13.el9.i686", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.10.4-13.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.ppc64le" }, "product_reference": "libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.10.4-13.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.s390x" }, "product_reference": "libssh-debuginfo-0:0.10.4-13.el9.s390x", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.10.4-13.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.x86_64" }, "product_reference": "libssh-debuginfo-0:0.10.4-13.el9.x86_64", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.10.4-13.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.aarch64" }, "product_reference": "libssh-debugsource-0:0.10.4-13.el9.aarch64", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.10.4-13.el9.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.i686" }, "product_reference": "libssh-debugsource-0:0.10.4-13.el9.i686", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.10.4-13.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.ppc64le" }, "product_reference": "libssh-debugsource-0:0.10.4-13.el9.ppc64le", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.10.4-13.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.s390x" }, "product_reference": "libssh-debugsource-0:0.10.4-13.el9.s390x", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.10.4-13.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.x86_64" }, "product_reference": "libssh-debugsource-0:0.10.4-13.el9.x86_64", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.10.4-13.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.aarch64" }, "product_reference": "libssh-devel-0:0.10.4-13.el9.aarch64", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.10.4-13.el9.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.i686" }, "product_reference": "libssh-devel-0:0.10.4-13.el9.i686", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.10.4-13.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.ppc64le" }, "product_reference": "libssh-devel-0:0.10.4-13.el9.ppc64le", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.10.4-13.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.s390x" }, "product_reference": "libssh-devel-0:0.10.4-13.el9.s390x", "relates_to_product_reference": "BaseOS-9.4.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.10.4-13.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.x86_64" }, "product_reference": "libssh-devel-0:0.10.4-13.el9.x86_64", "relates_to_product_reference": "BaseOS-9.4.0.GA" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "vinci@protonmail.ch" ] }, { "names": [ "Norbert Pocs" ], "organization": "libssh" } ], "cve": "CVE-2023-6004", "cwe": { "id": "CWE-74", "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)" }, "discovery_date": "2023-11-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2251110" } ], "notes": [ { "category": "description", "text": "A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.", "title": "Vulnerability description" }, { "category": "summary", "text": "libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname", "title": "Vulnerability summary" }, { "category": "other", "text": "Despite the potential severity of this issue, the requirement for user interaction to exploit the vulnerability has led to a low severity rating. As a precautionary measure, users are advised to sanitize hostname inputs as a mitigation strategy.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.src", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-config-0:0.10.4-13.el9.noarch", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.src", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-config-0:0.10.4-13.el9.noarch", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-6004" }, { "category": "external", "summary": "RHBZ#2251110", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251110" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-6004", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6004" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-6004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6004" }, { "category": "external", "summary": "https://www.libssh.org/security/advisories/CVE-2023-6004.txt", "url": "https://www.libssh.org/security/advisories/CVE-2023-6004.txt" } ], "release_date": "2023-12-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-04-30T10:22:20+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing these updated packages, all running applications using libssh must be restarted for this update to take effect.", "product_ids": [ "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.src", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-config-0:0.10.4-13.el9.noarch", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.src", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-config-0:0.10.4-13.el9.noarch", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:2504" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.src", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-config-0:0.10.4-13.el9.noarch", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.src", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-config-0:0.10.4-13.el9.noarch", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.src", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-config-0:0.10.4-13.el9.noarch", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.src", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-config-0:0.10.4-13.el9.noarch", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname" }, { "acknowledgments": [ { "names": [ "Jack Weinstein" ], "organization": "\u003cmike.code.bb.h@gmail.com\u003e" } ], "cve": "CVE-2023-6918", "cwe": { "id": "CWE-252", "name": "Unchecked Return Value" }, "discovery_date": "2023-12-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2254997" } ], "notes": [ { "category": "description", "text": "A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.", "title": "Vulnerability description" }, { "category": "summary", "text": "libssh: Missing checks for return values for digests", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability in the libssh abstract layer for message digest operations is deemed to have a low impact due to several mitigating factors. Primarily, the absence of proper checks on return values from supported crypto backends may lead to low-memory situations, failures, NULL dereferences, crashes, or the utilization of uninitialized memory in the Key Derivation Function (KDF). While these potential consequences could disrupt the system, their likelihood is considered low, contributing to the low impact classification.\n\nThe maintainers of libssh, in conjunction with Red Hat, have assigned a CVSS3.1 score of 3.7 to this vulnerability. While the score acknowledges the existence of a vulnerability, the assigned value falls within the lower range of the scale, indicating a relatively modest level of risk.\n\nMoreover, the practical exploitability of this vulnerability is characterized as theoretical and highly unlikely to yield tangible results. The difficulty in successfully exploiting the flaw adds a layer of security, further diminishing the potential impact. While acknowledging the risk of non-matching keys leading to decryption/integrity failures and connection termination, the combination of the low likelihood of exploitation and the relatively lower severity score results in an overall assessment of low impact.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.src", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-config-0:0.10.4-13.el9.noarch", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.src", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-config-0:0.10.4-13.el9.noarch", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-6918" }, { "category": "external", "summary": "RHBZ#2254997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-6918", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-6918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6918" }, { "category": "external", "summary": "https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/", "url": "https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/" }, { "category": "external", "summary": "https://www.libssh.org/security/advisories/CVE-2023-6918.txt", "url": "https://www.libssh.org/security/advisories/CVE-2023-6918.txt" } ], "release_date": "2023-12-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-04-30T10:22:20+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing these updated packages, all running applications using libssh must be restarted for this update to take effect.", "product_ids": [ "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.src", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-config-0:0.10.4-13.el9.noarch", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.src", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-config-0:0.10.4-13.el9.noarch", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:2504" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.src", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-config-0:0.10.4-13.el9.noarch", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.src", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-config-0:0.10.4-13.el9.noarch", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.src", "AppStream-9.4.0.GA:libssh-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-config-0:0.10.4-13.el9.noarch", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.x86_64", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.aarch64", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.i686", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.ppc64le", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.s390x", "AppStream-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.src", "BaseOS-9.4.0.GA:libssh-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-config-0:0.10.4-13.el9.noarch", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-debuginfo-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-debugsource-0:0.10.4-13.el9.x86_64", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.aarch64", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.i686", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.ppc64le", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.s390x", "BaseOS-9.4.0.GA:libssh-devel-0:0.10.4-13.el9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libssh: Missing checks for return values for digests" } ] }
rhsa-2024_3233
Vulnerability from csaf_redhat
Published
2024-05-22 10:24
Modified
2024-11-06 05:56
Summary
Red Hat Security Advisory: libssh security update
Notes
Topic
An update for libssh is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.
Security Fix(es):
* libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname (CVE-2023-6004)
* libssh: Missing checks for return values for digests (CVE-2023-6918)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Low" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for libssh is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname (CVE-2023-6004)\n\n* libssh: Missing checks for return values for digests (CVE-2023-6918)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2024:3233", "url": "https://access.redhat.com/errata/RHSA-2024:3233" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#low", "url": "https://access.redhat.com/security/updates/classification/#low" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index" }, { "category": "external", "summary": "2251110", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251110" }, { "category": "external", "summary": "2254997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254997" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3233.json" } ], "title": "Red Hat Security Advisory: libssh security update", "tracking": { "current_release_date": "2024-11-06T05:56:20+00:00", "generator": { "date": "2024-11-06T05:56:20+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2024:3233", "initial_release_date": "2024-05-22T10:24:35+00:00", "revision_history": [ { "date": "2024-05-22T10:24:35+00:00", "number": "1", "summary": "Initial version" }, { "date": "2024-05-22T10:24:35+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T05:56:20+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux BaseOS (v. 8)", "product": { "name": "Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:8::baseos" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "libssh-devel-0:0.9.6-14.el8.aarch64", "product": { "name": "libssh-devel-0:0.9.6-14.el8.aarch64", "product_id": "libssh-devel-0:0.9.6-14.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-devel@0.9.6-14.el8?arch=aarch64" } } }, { "category": "product_version", "name": "libssh-debugsource-0:0.9.6-14.el8.aarch64", "product": { "name": "libssh-debugsource-0:0.9.6-14.el8.aarch64", "product_id": "libssh-debugsource-0:0.9.6-14.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debugsource@0.9.6-14.el8?arch=aarch64" } } }, { "category": "product_version", "name": "libssh-debuginfo-0:0.9.6-14.el8.aarch64", "product": { "name": "libssh-debuginfo-0:0.9.6-14.el8.aarch64", "product_id": "libssh-debuginfo-0:0.9.6-14.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debuginfo@0.9.6-14.el8?arch=aarch64" } } }, { "category": "product_version", "name": "libssh-0:0.9.6-14.el8.aarch64", "product": { "name": "libssh-0:0.9.6-14.el8.aarch64", "product_id": "libssh-0:0.9.6-14.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh@0.9.6-14.el8?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "libssh-devel-0:0.9.6-14.el8.ppc64le", "product": { "name": "libssh-devel-0:0.9.6-14.el8.ppc64le", "product_id": "libssh-devel-0:0.9.6-14.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-devel@0.9.6-14.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "libssh-debugsource-0:0.9.6-14.el8.ppc64le", "product": { "name": "libssh-debugsource-0:0.9.6-14.el8.ppc64le", "product_id": "libssh-debugsource-0:0.9.6-14.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debugsource@0.9.6-14.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "product": { "name": "libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "product_id": "libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debuginfo@0.9.6-14.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "libssh-0:0.9.6-14.el8.ppc64le", "product": { "name": "libssh-0:0.9.6-14.el8.ppc64le", "product_id": "libssh-0:0.9.6-14.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh@0.9.6-14.el8?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "libssh-devel-0:0.9.6-14.el8.i686", "product": { "name": "libssh-devel-0:0.9.6-14.el8.i686", "product_id": "libssh-devel-0:0.9.6-14.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-devel@0.9.6-14.el8?arch=i686" } } }, { "category": "product_version", "name": "libssh-debugsource-0:0.9.6-14.el8.i686", "product": { "name": "libssh-debugsource-0:0.9.6-14.el8.i686", "product_id": "libssh-debugsource-0:0.9.6-14.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debugsource@0.9.6-14.el8?arch=i686" } } }, { "category": "product_version", "name": "libssh-debuginfo-0:0.9.6-14.el8.i686", "product": { "name": "libssh-debuginfo-0:0.9.6-14.el8.i686", "product_id": "libssh-debuginfo-0:0.9.6-14.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debuginfo@0.9.6-14.el8?arch=i686" } } }, { "category": "product_version", "name": "libssh-0:0.9.6-14.el8.i686", "product": { "name": "libssh-0:0.9.6-14.el8.i686", "product_id": "libssh-0:0.9.6-14.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh@0.9.6-14.el8?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "libssh-devel-0:0.9.6-14.el8.x86_64", "product": { "name": "libssh-devel-0:0.9.6-14.el8.x86_64", "product_id": "libssh-devel-0:0.9.6-14.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-devel@0.9.6-14.el8?arch=x86_64" } } }, { "category": "product_version", "name": "libssh-debugsource-0:0.9.6-14.el8.x86_64", "product": { "name": "libssh-debugsource-0:0.9.6-14.el8.x86_64", "product_id": "libssh-debugsource-0:0.9.6-14.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debugsource@0.9.6-14.el8?arch=x86_64" } } }, { "category": "product_version", "name": "libssh-debuginfo-0:0.9.6-14.el8.x86_64", "product": { "name": "libssh-debuginfo-0:0.9.6-14.el8.x86_64", "product_id": "libssh-debuginfo-0:0.9.6-14.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debuginfo@0.9.6-14.el8?arch=x86_64" } } }, { "category": "product_version", "name": "libssh-0:0.9.6-14.el8.x86_64", "product": { "name": "libssh-0:0.9.6-14.el8.x86_64", "product_id": "libssh-0:0.9.6-14.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh@0.9.6-14.el8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "libssh-devel-0:0.9.6-14.el8.s390x", "product": { "name": "libssh-devel-0:0.9.6-14.el8.s390x", "product_id": "libssh-devel-0:0.9.6-14.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-devel@0.9.6-14.el8?arch=s390x" } } }, { "category": "product_version", "name": "libssh-debugsource-0:0.9.6-14.el8.s390x", "product": { "name": "libssh-debugsource-0:0.9.6-14.el8.s390x", "product_id": "libssh-debugsource-0:0.9.6-14.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debugsource@0.9.6-14.el8?arch=s390x" } } }, { "category": "product_version", "name": "libssh-debuginfo-0:0.9.6-14.el8.s390x", "product": { "name": "libssh-debuginfo-0:0.9.6-14.el8.s390x", "product_id": "libssh-debuginfo-0:0.9.6-14.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-debuginfo@0.9.6-14.el8?arch=s390x" } } }, { "category": "product_version", "name": "libssh-0:0.9.6-14.el8.s390x", "product": { "name": "libssh-0:0.9.6-14.el8.s390x", "product_id": "libssh-0:0.9.6-14.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh@0.9.6-14.el8?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "libssh-0:0.9.6-14.el8.src", "product": { "name": "libssh-0:0.9.6-14.el8.src", "product_id": "libssh-0:0.9.6-14.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh@0.9.6-14.el8?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "libssh-config-0:0.9.6-14.el8.noarch", "product": { "name": "libssh-config-0:0.9.6-14.el8.noarch", "product_id": "libssh-config-0:0.9.6-14.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/libssh-config@0.9.6-14.el8?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.9.6-14.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.aarch64" }, "product_reference": "libssh-0:0.9.6-14.el8.aarch64", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.9.6-14.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.i686" }, "product_reference": "libssh-0:0.9.6-14.el8.i686", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.9.6-14.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.ppc64le" }, "product_reference": "libssh-0:0.9.6-14.el8.ppc64le", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.9.6-14.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.s390x" }, "product_reference": "libssh-0:0.9.6-14.el8.s390x", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.9.6-14.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.src" }, "product_reference": "libssh-0:0.9.6-14.el8.src", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.9.6-14.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.x86_64" }, "product_reference": "libssh-0:0.9.6-14.el8.x86_64", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-config-0:0.9.6-14.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-config-0:0.9.6-14.el8.noarch" }, "product_reference": "libssh-config-0:0.9.6-14.el8.noarch", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.9.6-14.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.aarch64" }, "product_reference": "libssh-debuginfo-0:0.9.6-14.el8.aarch64", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.9.6-14.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.i686" }, "product_reference": "libssh-debuginfo-0:0.9.6-14.el8.i686", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.9.6-14.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.ppc64le" }, "product_reference": "libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.9.6-14.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.s390x" }, "product_reference": "libssh-debuginfo-0:0.9.6-14.el8.s390x", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.9.6-14.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.x86_64" }, "product_reference": "libssh-debuginfo-0:0.9.6-14.el8.x86_64", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.9.6-14.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.aarch64" }, "product_reference": "libssh-debugsource-0:0.9.6-14.el8.aarch64", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.9.6-14.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.i686" }, "product_reference": "libssh-debugsource-0:0.9.6-14.el8.i686", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.9.6-14.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.ppc64le" }, "product_reference": "libssh-debugsource-0:0.9.6-14.el8.ppc64le", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.9.6-14.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.s390x" }, "product_reference": "libssh-debugsource-0:0.9.6-14.el8.s390x", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.9.6-14.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.x86_64" }, "product_reference": "libssh-debugsource-0:0.9.6-14.el8.x86_64", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.9.6-14.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.aarch64" }, "product_reference": "libssh-devel-0:0.9.6-14.el8.aarch64", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.9.6-14.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.i686" }, "product_reference": "libssh-devel-0:0.9.6-14.el8.i686", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.9.6-14.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.ppc64le" }, "product_reference": "libssh-devel-0:0.9.6-14.el8.ppc64le", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.9.6-14.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.s390x" }, "product_reference": "libssh-devel-0:0.9.6-14.el8.s390x", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.9.6-14.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.x86_64" }, "product_reference": "libssh-devel-0:0.9.6-14.el8.x86_64", "relates_to_product_reference": "AppStream-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.9.6-14.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.aarch64" }, "product_reference": "libssh-0:0.9.6-14.el8.aarch64", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.9.6-14.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.i686" }, "product_reference": "libssh-0:0.9.6-14.el8.i686", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.9.6-14.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.ppc64le" }, "product_reference": "libssh-0:0.9.6-14.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.9.6-14.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.s390x" }, "product_reference": "libssh-0:0.9.6-14.el8.s390x", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.9.6-14.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.src" }, "product_reference": "libssh-0:0.9.6-14.el8.src", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-0:0.9.6-14.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.x86_64" }, "product_reference": "libssh-0:0.9.6-14.el8.x86_64", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-config-0:0.9.6-14.el8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-config-0:0.9.6-14.el8.noarch" }, "product_reference": "libssh-config-0:0.9.6-14.el8.noarch", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.9.6-14.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.aarch64" }, "product_reference": "libssh-debuginfo-0:0.9.6-14.el8.aarch64", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.9.6-14.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.i686" }, "product_reference": "libssh-debuginfo-0:0.9.6-14.el8.i686", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.9.6-14.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.ppc64le" }, "product_reference": "libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.9.6-14.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.s390x" }, "product_reference": "libssh-debuginfo-0:0.9.6-14.el8.s390x", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debuginfo-0:0.9.6-14.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.x86_64" }, "product_reference": "libssh-debuginfo-0:0.9.6-14.el8.x86_64", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.9.6-14.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.aarch64" }, "product_reference": "libssh-debugsource-0:0.9.6-14.el8.aarch64", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.9.6-14.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.i686" }, "product_reference": "libssh-debugsource-0:0.9.6-14.el8.i686", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.9.6-14.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.ppc64le" }, "product_reference": "libssh-debugsource-0:0.9.6-14.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.9.6-14.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.s390x" }, "product_reference": "libssh-debugsource-0:0.9.6-14.el8.s390x", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-debugsource-0:0.9.6-14.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.x86_64" }, "product_reference": "libssh-debugsource-0:0.9.6-14.el8.x86_64", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.9.6-14.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.aarch64" }, "product_reference": "libssh-devel-0:0.9.6-14.el8.aarch64", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.9.6-14.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.i686" }, "product_reference": "libssh-devel-0:0.9.6-14.el8.i686", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.9.6-14.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.ppc64le" }, "product_reference": "libssh-devel-0:0.9.6-14.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.9.6-14.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.s390x" }, "product_reference": "libssh-devel-0:0.9.6-14.el8.s390x", "relates_to_product_reference": "BaseOS-8.10.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "libssh-devel-0:0.9.6-14.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.x86_64" }, "product_reference": "libssh-devel-0:0.9.6-14.el8.x86_64", "relates_to_product_reference": "BaseOS-8.10.0.GA" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "vinci@protonmail.ch" ] }, { "names": [ "Norbert Pocs" ], "organization": "libssh" } ], "cve": "CVE-2023-6004", "cwe": { "id": "CWE-74", "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)" }, "discovery_date": "2023-11-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2251110" } ], "notes": [ { "category": "description", "text": "A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.", "title": "Vulnerability description" }, { "category": "summary", "text": "libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname", "title": "Vulnerability summary" }, { "category": "other", "text": "Despite the potential severity of this issue, the requirement for user interaction to exploit the vulnerability has led to a low severity rating. As a precautionary measure, users are advised to sanitize hostname inputs as a mitigation strategy.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.src", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-config-0:0.9.6-14.el8.noarch", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.src", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-config-0:0.9.6-14.el8.noarch", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-6004" }, { "category": "external", "summary": "RHBZ#2251110", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251110" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-6004", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6004" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-6004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6004" }, { "category": "external", "summary": "https://www.libssh.org/security/advisories/CVE-2023-6004.txt", "url": "https://www.libssh.org/security/advisories/CVE-2023-6004.txt" } ], "release_date": "2023-12-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-22T10:24:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing these updated packages, all running applications using libssh must be restarted for this update to take effect.", "product_ids": [ "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.src", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-config-0:0.9.6-14.el8.noarch", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.src", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-config-0:0.9.6-14.el8.noarch", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3233" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.src", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-config-0:0.9.6-14.el8.noarch", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.src", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-config-0:0.9.6-14.el8.noarch", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.src", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-config-0:0.9.6-14.el8.noarch", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.src", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-config-0:0.9.6-14.el8.noarch", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname" }, { "acknowledgments": [ { "names": [ "Jack Weinstein" ], "organization": "\u003cmike.code.bb.h@gmail.com\u003e" } ], "cve": "CVE-2023-6918", "cwe": { "id": "CWE-252", "name": "Unchecked Return Value" }, "discovery_date": "2023-12-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2254997" } ], "notes": [ { "category": "description", "text": "A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.", "title": "Vulnerability description" }, { "category": "summary", "text": "libssh: Missing checks for return values for digests", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability in the libssh abstract layer for message digest operations is deemed to have a low impact due to several mitigating factors. Primarily, the absence of proper checks on return values from supported crypto backends may lead to low-memory situations, failures, NULL dereferences, crashes, or the utilization of uninitialized memory in the Key Derivation Function (KDF). While these potential consequences could disrupt the system, their likelihood is considered low, contributing to the low impact classification.\n\nThe maintainers of libssh, in conjunction with Red Hat, have assigned a CVSS3.1 score of 3.7 to this vulnerability. While the score acknowledges the existence of a vulnerability, the assigned value falls within the lower range of the scale, indicating a relatively modest level of risk.\n\nMoreover, the practical exploitability of this vulnerability is characterized as theoretical and highly unlikely to yield tangible results. The difficulty in successfully exploiting the flaw adds a layer of security, further diminishing the potential impact. While acknowledging the risk of non-matching keys leading to decryption/integrity failures and connection termination, the combination of the low likelihood of exploitation and the relatively lower severity score results in an overall assessment of low impact.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.src", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-config-0:0.9.6-14.el8.noarch", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.src", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-config-0:0.9.6-14.el8.noarch", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-6918" }, { "category": "external", "summary": "RHBZ#2254997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-6918", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-6918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6918" }, { "category": "external", "summary": "https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/", "url": "https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/" }, { "category": "external", "summary": "https://www.libssh.org/security/advisories/CVE-2023-6918.txt", "url": "https://www.libssh.org/security/advisories/CVE-2023-6918.txt" } ], "release_date": "2023-12-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-22T10:24:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing these updated packages, all running applications using libssh must be restarted for this update to take effect.", "product_ids": [ "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.src", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-config-0:0.9.6-14.el8.noarch", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.src", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-config-0:0.9.6-14.el8.noarch", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3233" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.src", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-config-0:0.9.6-14.el8.noarch", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.src", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-config-0:0.9.6-14.el8.noarch", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.src", "AppStream-8.10.0.GA:libssh-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-config-0:0.9.6-14.el8.noarch", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.x86_64", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.aarch64", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.i686", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.ppc64le", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.s390x", "AppStream-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.src", "BaseOS-8.10.0.GA:libssh-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-config-0:0.9.6-14.el8.noarch", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-debuginfo-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-debugsource-0:0.9.6-14.el8.x86_64", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.aarch64", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.i686", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.ppc64le", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.s390x", "BaseOS-8.10.0.GA:libssh-devel-0:0.9.6-14.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libssh: Missing checks for return values for digests" } ] }
wid-sec-w-2024-1307
Vulnerability from csaf_certbund
Published
2024-06-06 22:00
Modified
2024-06-13 22:00
Summary
Red Hat OpenShift Service Mesh Containers: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Red Hat OpenShift ist eine "Platform as a Service" (PaaS) Lösung zur Bereitstellung von Applikationen in der Cloud.
Angriff
Ein Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh Containers ausnutzen, um Dateien zu manipulieren, einen 'Denial of Service'-Zustand erzuegen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuführen.
Betroffene Betriebssysteme
- Sonstiges
- UNIX
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Red Hat OpenShift ist eine \"Platform as a Service\" (PaaS) L\u00f6sung zur Bereitstellung von Applikationen in der Cloud.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh Containers ausnutzen, um Dateien zu manipulieren, einen \u0027Denial of Service\u0027-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Sonstiges\n- UNIX", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-1307 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1307.json" }, { "category": "self", "summary": "WID-SEC-2024-1307 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1307" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:3680 vom 2024-06-06", "url": "https://access.redhat.com/errata/RHSA-2024:3680" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:3683 vom 2024-06-06", "url": "https://access.redhat.com/errata/RHSA-2024:3683" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:3790 vom 2024-06-11", "url": "https://access.redhat.com/errata/RHSA-2024:3790" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:3314 vom 2024-06-13", "url": "https://access.redhat.com/errata/RHSA-2024:3314" } ], "source_lang": "en-US", "title": "Red Hat OpenShift Service Mesh Containers: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-06-13T22:00:00.000+00:00", "generator": { "date": "2024-06-14T08:08:17.851+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2024-1307", "initial_release_date": "2024-06-06T22:00:00.000+00:00", "revision_history": [ { "date": "2024-06-06T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2024-06-10T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-06-13T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Red Hat aufgenommen" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } }, { "branches": [ { "category": "product_version_range", "name": "Service Mesh Containers \u003c2.5.2", "product": { "name": "Red Hat OpenShift Service Mesh Containers \u003c2.5.2", "product_id": "T035259", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:service_mesh_containers__2.5.2" } } }, { "category": "product_version_range", "name": "Service Mesh Containers \u003c2.4.8", "product": { "name": "Red Hat OpenShift Service Mesh Containers \u003c2.4.8", "product_id": "T035260", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:service_mesh_containers__2.4.8" } } } ], "category": "product_name", "name": "OpenShift" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-25220", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2021-25220" }, { "cve": "CVE-2021-43618", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2021-43618" }, { "cve": "CVE-2021-46848", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2021-46848" }, { "cve": "CVE-2022-1271", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2022-1271" }, { "cve": "CVE-2022-2795", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2022-2795" }, { "cve": "CVE-2022-3094", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2022-3094" }, { "cve": "CVE-2022-36227", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2022-36227" }, { "cve": "CVE-2022-47024", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2022-47024" }, { "cve": "CVE-2022-47629", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2022-47629" }, { "cve": "CVE-2022-48303", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2022-48303" }, { "cve": "CVE-2022-48468", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2022-48468" }, { "cve": "CVE-2022-48554", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2022-48554" }, { "cve": "CVE-2022-48624", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2022-48624" }, { "cve": "CVE-2023-22745", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-22745" }, { "cve": "CVE-2023-2602", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-2602" }, { "cve": "CVE-2023-2603", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-2603" }, { "cve": "CVE-2023-29491", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-29491" }, { "cve": "CVE-2023-2975", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-2975" }, { "cve": "CVE-2023-3446", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-3446" }, { "cve": "CVE-2023-36054", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-36054" }, { "cve": "CVE-2023-3817", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-3817" }, { "cve": "CVE-2023-39975", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-39975" }, { "cve": "CVE-2023-4408", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-4408" }, { "cve": "CVE-2023-44487", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-44487" }, { "cve": "CVE-2023-45288", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-45288" }, { "cve": "CVE-2023-4641", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-4641" }, { "cve": "CVE-2023-4692", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-4692" }, { "cve": "CVE-2023-4693", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-4693" }, { "cve": "CVE-2023-47038", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-47038" }, { "cve": "CVE-2023-50387", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-50387" }, { "cve": "CVE-2023-50868", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-50868" }, { "cve": "CVE-2023-5517", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-5517" }, { "cve": "CVE-2023-5678", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-5678" }, { "cve": "CVE-2023-5679", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-5679" }, { "cve": "CVE-2023-6004", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-6004" }, { "cve": "CVE-2023-6129", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-6129" }, { "cve": "CVE-2023-6237", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-6237" }, { "cve": "CVE-2023-6516", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-6516" }, { "cve": "CVE-2023-6597", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-6597" }, { "cve": "CVE-2023-6918", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-6918" }, { "cve": "CVE-2023-7008", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-7008" }, { "cve": "CVE-2023-7104", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2023-7104" }, { "cve": "CVE-2024-0450", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2024-0450" }, { "cve": "CVE-2024-0727", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2024-0727" }, { "cve": "CVE-2024-1048", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2024-1048" }, { "cve": "CVE-2024-1313", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2024-1313" }, { "cve": "CVE-2024-1394", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2024-1394" }, { "cve": "CVE-2024-22195", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2024-22195" }, { "cve": "CVE-2024-22365", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2024-22365" }, { "cve": "CVE-2024-24786", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2024-24786" }, { "cve": "CVE-2024-25062", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2024-25062" }, { "cve": "CVE-2024-26458", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2024-26458" }, { "cve": "CVE-2024-26461", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2024-26461" }, { "cve": "CVE-2024-28834", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2024-28834" }, { "cve": "CVE-2024-28835", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2024-28835" }, { "cve": "CVE-2024-2961", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2024-2961" }, { "cve": "CVE-2024-33599", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2024-33599" }, { "cve": "CVE-2024-33600", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2024-33600" }, { "cve": "CVE-2024-33601", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2024-33601" }, { "cve": "CVE-2024-33602", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuf\u00fchren, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "67646" ] }, "release_date": "2024-06-06T22:00:00Z", "title": "CVE-2024-33602" } ] }
wid-sec-w-2023-3175
Vulnerability from csaf_certbund
Published
2023-12-18 23:00
Modified
2024-05-21 22:00
Summary
libssh: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
libssh ist eine C Bibliothek für das Anbieten von SSH Diensten auf Client- und Serverseite. Sie kann genutzt werden, um aus der Ferne Programme auszuführen, Dateien zu übertragen oder als sicherer und transparenter Tunnel für entfernte Programme genutzt werden.
Angriff
Ein lokaler Angreifer kann mehrere Schwachstellen in libssh ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service zu verursachen
Betroffene Betriebssysteme
- Linux
- UNIX
- Windows
{ "document": { "aggregate_severity": { "text": "niedrig" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "libssh ist eine C Bibliothek f\u00fcr das Anbieten von SSH Diensten auf Client- und Serverseite. Sie kann genutzt werden, um aus der Ferne Programme auszuf\u00fchren, Dateien zu \u00fcbertragen oder als sicherer und transparenter Tunnel f\u00fcr entfernte Programme genutzt werden.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein lokaler Angreifer kann mehrere Schwachstellen in libssh ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service zu verursachen", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-3175 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-3175.json" }, { "category": "self", "summary": "WID-SEC-2023-3175 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-3175" }, { "category": "external", "summary": "Meinberg Security Advisory", "url": "https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2024-01-lantime-firmware-v7-08-007.htm" }, { "category": "external", "summary": "libsshs ecurity releases vom 2023-12-18", "url": "https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/" }, { "category": "external", "summary": "Ubuntu Security Notice USN-6592-2 vom 2024-02-05", "url": "https://ubuntu.com/security/notices/USN-6592-2" }, { "category": "external", "summary": "Ubuntu Security Notice USN-6592-2 vom 2024-02-05", "url": "https://www.cybersecurity-help.cz/vdb/SB2024020526" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:0140-1 vom 2024-01-18", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-January/017678.html" }, { "category": "external", "summary": "Fedora Security Advisory FEDORA-2023-55800423A8 vom 2023-12-23", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2023-55800423a8" }, { "category": "external", "summary": "Gentoo Linux Security Advisory GLSA-202312-16 vom 2023-12-28", "url": "https://security.gentoo.org/glsa/202312-16" }, { "category": "external", "summary": "Debian Security Advisory DSA-5591 vom 2023-12-28", "url": "https://lists.debian.org/debian-security-announce/2023/msg00288.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:0539-1 vom 2024-02-20", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-February/017974.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-6592-1 vom 2024-01-22", "url": "https://ubuntu.com/security/notices/USN-6592-1" }, { "category": "external", "summary": "Dell Security Advisory DSA-2024-198 vom 2024-05-08", "url": "https://www.dell.com/support/kbdoc/000224827/dsa-2024-=" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:3233 vom 2024-05-22", "url": "https://access.redhat.com/errata/RHSA-2024:3233" } ], "source_lang": "en-US", "title": "libssh: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-05-21T22:00:00.000+00:00", "generator": { "date": "2024-05-22T08:37:24.081+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-3175", "initial_release_date": "2023-12-18T23:00:00.000+00:00", "revision_history": [ { "date": "2023-12-18T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-12-26T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Fedora aufgenommen" }, { "date": "2023-12-27T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Gentoo aufgenommen" }, { "date": "2023-12-28T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2024-01-18T23:00:00.000+00:00", "number": "5", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2024-01-22T23:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2024-01-30T23:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Meinberg aufgenommen" }, { "date": "2024-02-05T23:00:00.000+00:00", "number": "8", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2024-02-20T23:00:00.000+00:00", "number": "9", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2024-05-07T22:00:00.000+00:00", "number": "10", "summary": "Neue Updates von Dell aufgenommen" }, { "date": "2024-05-21T22:00:00.000+00:00", "number": "11", "summary": "Neue Updates von Red Hat aufgenommen" } ], "status": "final", "version": "11" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "virtual", "product": { "name": "Dell NetWorker virtual", "product_id": "T034583", "product_identification_helper": { "cpe": "cpe:/a:dell:networker:virtual" } } } ], "category": "product_name", "name": "NetWorker" } ], "category": "vendor", "name": "Dell" }, { "branches": [ { "category": "product_name", "name": "EMC Avamar", "product": { "name": "EMC Avamar", "product_id": "T014381", "product_identification_helper": { "cpe": "cpe:/a:emc:avamar:-" } } } ], "category": "vendor", "name": "EMC" }, { "branches": [ { "category": "product_name", "name": "Fedora Linux", "product": { "name": "Fedora Linux", "product_id": "74185", "product_identification_helper": { "cpe": "cpe:/o:fedoraproject:fedora:-" } } } ], "category": "vendor", "name": "Fedora" }, { "branches": [ { "category": "product_name", "name": "Gentoo Linux", "product": { "name": "Gentoo Linux", "product_id": "T012167", "product_identification_helper": { "cpe": "cpe:/o:gentoo:linux:-" } } } ], "category": "vendor", "name": "Gentoo" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c7.08.007", "product": { "name": "Meinberg LANTIME \u003c7.08.007", "product_id": "T032435", "product_identification_helper": { "cpe": "cpe:/h:meinberg:lantime:7.08.007" } } } ], "category": "product_name", "name": "LANTIME" } ], "category": "vendor", "name": "Meinberg" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c0.10.6", "product": { "name": "Open Source libssh \u003c0.10.6", "product_id": "T031750", "product_identification_helper": { "cpe": "cpe:/a:libssh:libssh:0.10.6" } } }, { "category": "product_version_range", "name": "\u003c0.9.8", "product": { "name": "Open Source libssh \u003c0.9.8", "product_id": "T031751", "product_identification_helper": { "cpe": "cpe:/a:libssh:libssh:0.9.8" } } } ], "category": "product_name", "name": "libssh" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "category": "product_name", "name": "Ubuntu Linux", "product": { "name": "Ubuntu Linux", "product_id": "T000126", "product_identification_helper": { "cpe": "cpe:/o:canonical:ubuntu_linux:-" } } } ], "category": "vendor", "name": "Ubuntu" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-6004", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in libssh. Die Hostnamensyntax auf dem Client wird ungen\u00fcgend \u00fcberpr\u00fcft. Dadurch kann bei der Verwendung der ProxyCommand- oder ProxyJump-Funktion sch\u00e4dlicher Code \u00fcber den Hostnamenparameter in Befehle eingeschleust werden. Ein Angreifer kann diese Schwachstelle ausnutzen, um Code auszuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T032435", "T014381", "2951", "T002207", "67646", "T000126", "T034583", "T012167", "74185" ] }, "release_date": "2023-12-18T23:00:00Z", "title": "CVE-2023-6004" }, { "cve": "CVE-2023-6918", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in libssh. Die Bibliothek f\u00fchrt MD-Operationen \u00fcber verschiedene Krypto-Backends durch. Die R\u00fcckgabewerte werden nicht korrekt \u00fcberpr\u00fcft, was zu Fehlern, Abst\u00fcrzen und m\u00f6glicherweise zur Verwendung von nicht initialisiertem Speicher f\u00fchren kann. Ein Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T032435", "T014381", "2951", "T002207", "67646", "T000126", "T034583", "T012167", "74185" ] }, "release_date": "2023-12-18T23:00:00Z", "title": "CVE-2023-6918" } ] }
ghsa-gpcj-wh2f-rr23
Vulnerability from github
Published
2023-12-19 00:30
Modified
2024-05-22 18:30
Severity ?
Details
A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.
{ "affected": [], "aliases": [ "CVE-2023-6918" ], "database_specific": { "cwe_ids": [ "CWE-252" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-19T00:15:08Z", "severity": "LOW" }, "details": "A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.", "id": "GHSA-gpcj-wh2f-rr23", "modified": "2024-05-22T18:30:38Z", "published": "2023-12-19T00:30:21Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6918" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:2504" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:3233" }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2023-6918" }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254997" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB" }, { "type": "WEB", "url": "https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases" }, { "type": "WEB", "url": "https://www.libssh.org/security/advisories/CVE-2023-6918.txt" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "type": "CVSS_V3" } ] }
gsd-2023-6918
Vulnerability from gsd
Modified
2023-12-19 06:01
Details
A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.
Aliases
{ "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2023-6918" ], "details": "A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.", "id": "GSD-2023-6918", "modified": "2023-12-19T06:01:18.007197Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "secalert@redhat.com", "ID": "CVE-2023-6918", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Red Hat Enterprise Linux 6", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "defaultStatus": "unknown" } } ] } }, { "product_name": "Red Hat Enterprise Linux 7", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "defaultStatus": "unknown" } }, { "version_value": "not down converted", "x_cve_json_5_version_data": { "defaultStatus": "unknown" } } ] } }, { "product_name": "Red Hat Enterprise Linux 8", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "defaultStatus": "affected" } } ] } }, { "product_name": "Red Hat Enterprise Linux 9", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "defaultStatus": "affected" } } ] } } ] }, "vendor_name": "Red Hat" } ] } }, "credits": [ { "lang": "en", "value": "Red Hat would like to thank Jack Weinstein (\u003cmike.code.bb.h@gmail.com\u003e) for reporting this issue." } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection." } ] }, "impact": { "cvss": [ { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "cweId": "CWE-252", "lang": "eng", "value": "Unchecked Return Value" } ] } ] }, "references": { "reference_data": [ { "name": "https://access.redhat.com/security/cve/CVE-2023-6918", "refsource": "MISC", "url": "https://access.redhat.com/security/cve/CVE-2023-6918" }, { "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2254997", "refsource": "MISC", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254997" }, { "name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/", "refsource": "MISC", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/" }, { "name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/", "refsource": "MISC", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/" }, { "name": "https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/", "refsource": "MISC", "url": "https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/" }, { "name": "https://www.libssh.org/security/advisories/CVE-2023-6918.txt", "refsource": "MISC", "url": "https://www.libssh.org/security/advisories/CVE-2023-6918.txt" } ] }, "work_around": [ { "lang": "en", "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability." } ] }, "nvd.nist.gov": { "cve": { "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*", "matchCriteriaId": "4836788D-9936-404F-B0A8-DDDAC3969F20", "versionEndExcluding": "0.9.8", "versionStartIncluding": "0.9.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*", "matchCriteriaId": "BCB546AC-788C-422E-B6BD-756BF39BD0F5", "versionEndExcluding": "0.10.6", "versionStartIncluding": "0.10.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*", "matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9", "vulnerable": true }, { "criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*", "matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646", "vulnerable": true }, { "criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943", "vulnerable": true }, { "criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "descriptions": [ { "lang": "en", "value": "A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection." }, { "lang": "es", "value": "Se encontr\u00f3 un fallo en la capa abstracta de implementaci\u00f3n de libssh para operaciones de resumen de mensajes (MD) implementadas por diferentes backends criptogr\u00e1ficos compatibles. Los valores de retorno de estos no se verificaron correctamente, lo que podr\u00eda causar fallas en situaciones de poca memoria, desreferencias NULL, fallas o uso de la memoria no inicializada como entrada para el KDF. En este caso, las claves que no coinciden resultar\u00e1n en fallas de descifrado/integridad, lo que terminar\u00e1 la conexi\u00f3n." } ], "id": "CVE-2023-6918", "lastModified": "2024-01-10T16:14:07.393", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary" }, { "cvssData": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "secalert@redhat.com", "type": "Secondary" } ] }, "published": "2023-12-19T00:15:08.460", "references": [ { "source": "secalert@redhat.com", "tags": [ "Mailing List", "Vendor Advisory" ], "url": "https://access.redhat.com/security/cve/CVE-2023-6918" }, { "source": "secalert@redhat.com", "tags": [ "Issue Tracking", "Third Party Advisory" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254997" }, { "source": "secalert@redhat.com", "tags": [ "Third Party Advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/" }, { "source": "secalert@redhat.com", "tags": [ "Mailing List", "Vendor Advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/" }, { "source": "secalert@redhat.com", "tags": [ "Release Notes" ], "url": "https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/" }, { "source": "secalert@redhat.com", "tags": [ "Vendor Advisory" ], "url": "https://www.libssh.org/security/advisories/CVE-2023-6918.txt" } ], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-252" } ], "source": "nvd@nist.gov", "type": "Primary" }, { "description": [ { "lang": "en", "value": "CWE-252" } ], "source": "secalert@redhat.com", "type": "Secondary" } ] } } } }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.