csaf_suse - suse-su-2024:0539-1

Vulnerability from csaf_suse

Published

2024-02-20 15:03

Modified

2024-02-20 15:03

Summary

Security update for libssh

Notes

Title of the patch

Security update for libssh

Description of the patch

This update for libssh fixes the following issues: Update to version 0.9.8 (jsc#PED-7719): * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) * Allow @ in usernames when parsing from URI composes Update to version 0.9.7 * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) * Fix CVE-2023-2283: a possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190) * Fix several memory leaks in GSSAPI handling code Update to version 0.9.6 (bsc#1189608, CVE-2021-3634) * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 Update to version 0.9.5 (bsc#1174713, CVE-2020-16135): * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) * Improve handling of library initialization (T222) * Fix parsing of subsecond times in SFTP (T219) * Make the documentation reproducible * Remove deprecated API usage in OpenSSL * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN * Define version in one place (T226) * Prevent invalid free when using different C runtimes than OpenSSL (T229) * Compatibility improvements to testsuite Update to version 0.9.4: * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ * Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) Update to version 0.9.3: * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state * SSH-01-006 General: Various unchecked Null-derefs cause DOS * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys * SSH-01-010 SSH: Deprecated hash function in fingerprinting * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access * SSH-01-001 State Machine: Initial machine states should be set explicitly * SSH-01-002 Kex: Differently bound macros used to iterate same array * SSH-01-005 Code-Quality: Integer sign confusion during assignments * SSH-01-008 SCP: Protocol Injection via unescaped File Names * SSH-01-009 SSH: Update documentation which RFCs are implemented * SSH-01-012 PKI: Information leak via uninitialized stack buffer Update to version 0.9.2: * Fixed libssh-config.cmake * Fixed issues with rsa algorithm negotiation (T191) * Fixed detection of OpenSSL ed25519 support (T197) Update to version 0.9.1: * Added support for Ed25519 via OpenSSL * Added support for X25519 via OpenSSL * Added support for localuser in Match keyword * Fixed Match keyword to be case sensitive * Fixed compilation with LibreSSL * Fixed error report of channel open (T75) * Fixed sftp documentation (T137) * Fixed known_hosts parsing (T156) * Fixed build issue with MinGW (T157) * Fixed build with gcc 9 (T164) * Fixed deprecation issues (T165) * Fixed known_hosts directory creation (T166) Update to verion 0.9.0: * Added support for AES-GCM * Added improved rekeying support * Added performance improvements * Disabled blowfish support by default * Fixed several ssh config parsing issues * Added support for DH Group Exchange KEX * Added support for Encrypt-then-MAC mode * Added support for parsing server side configuration file * Added support for ECDSA/Ed25519 certificates * Added FIPS 140-2 compatibility * Improved known_hosts parsing * Improved documentation * Improved OpenSSL API usage for KEX, DH, and signatures - Add libssh client and server config files

Patchnames

SUSE-2024-539,SUSE-SLE-SDK-12-SP5-2024-539,SUSE-SLE-SERVER-12-SP5-2024-539

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for libssh",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for libssh fixes the following issues:\n\nUpdate to version 0.9.8 (jsc#PED-7719):\n\n* Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209)\n* Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126)\n* Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186)\n* Allow @ in usernames when parsing from URI composes\n\nUpdate to version 0.9.7\n\n* Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm\n  guessing (bsc#1211188)\n* Fix CVE-2023-2283: a possible authorization bypass in\n  pki_verify_data_signature under low-memory conditions (bsc#1211190)\n* Fix several memory leaks in GSSAPI handling code\n\nUpdate to version 0.9.6 (bsc#1189608, CVE-2021-3634)\n\n* https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6\n\nUpdate to version 0.9.5 (bsc#1174713, CVE-2020-16135):\n\n* CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232)\n* Improve handling of library initialization (T222)\n* Fix parsing of subsecond times in SFTP (T219)\n* Make the documentation reproducible\n* Remove deprecated API usage in OpenSSL\n* Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN\n* Define version in one place (T226)\n* Prevent invalid free when using different C runtimes than OpenSSL (T229)\n* Compatibility improvements to testsuite \n\nUpdate to version 0.9.4:\n\n* https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/\n* Fix possible Denial of Service attack when using AES-CTR-ciphers\n  CVE-2020-1730 (bsc#1168699)\n\nUpdate to version 0.9.3:\n\n* Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095)\n* SSH-01-003 Client: Missing NULL check leads to crash in erroneous state\n* SSH-01-006 General: Various unchecked Null-derefs cause DOS\n* SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys\n* SSH-01-010 SSH: Deprecated hash function in fingerprinting\n* SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS\n* SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access\n* SSH-01-001 State Machine: Initial machine states should be set explicitly\n* SSH-01-002 Kex: Differently bound macros used to iterate same array\n* SSH-01-005 Code-Quality: Integer sign confusion during assignments\n* SSH-01-008 SCP: Protocol Injection via unescaped File Names\n* SSH-01-009 SSH: Update documentation which RFCs are implemented\n* SSH-01-012 PKI: Information leak via uninitialized stack buffer\n\nUpdate to version 0.9.2:\n\n* Fixed libssh-config.cmake\n* Fixed issues with rsa algorithm negotiation (T191)\n* Fixed detection of OpenSSL ed25519 support (T197)\n\nUpdate to version 0.9.1:\n\n* Added support for Ed25519 via OpenSSL\n* Added support for X25519 via OpenSSL\n* Added support for localuser in Match keyword\n* Fixed Match keyword to be case sensitive\n* Fixed compilation with LibreSSL\n* Fixed error report of channel open (T75)\n* Fixed sftp documentation (T137)\n* Fixed known_hosts parsing (T156)\n* Fixed build issue with MinGW (T157)\n* Fixed build with gcc 9 (T164)\n* Fixed deprecation issues (T165)\n* Fixed known_hosts directory creation (T166)\n\nUpdate to verion 0.9.0:\n\n* Added support for AES-GCM\n* Added improved rekeying support\n* Added performance improvements\n* Disabled blowfish support by default\n* Fixed several ssh config parsing issues\n* Added support for DH Group Exchange KEX\n* Added support for Encrypt-then-MAC mode\n* Added support for parsing server side configuration file\n* Added support for ECDSA/Ed25519 certificates\n* Added FIPS 140-2 compatibility\n* Improved known_hosts parsing\n* Improved documentation\n* Improved OpenSSL API usage for KEX, DH, and signatures\n\n- Add libssh client and server config files\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-2024-539,SUSE-SLE-SDK-12-SP5-2024-539,SUSE-SLE-SERVER-12-SP5-2024-539",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_0539-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2024:0539-1",
            url: "https://www.suse.com/support/update/announcement/2024/suse-su-20240539-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2024:0539-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2024-February/017974.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1158095",
            url: "https://bugzilla.suse.com/1158095",
         },
         {
            category: "self",
            summary: "SUSE Bug 1168699",
            url: "https://bugzilla.suse.com/1168699",
         },
         {
            category: "self",
            summary: "SUSE Bug 1174713",
            url: "https://bugzilla.suse.com/1174713",
         },
         {
            category: "self",
            summary: "SUSE Bug 1189608",
            url: "https://bugzilla.suse.com/1189608",
         },
         {
            category: "self",
            summary: "SUSE Bug 1211188",
            url: "https://bugzilla.suse.com/1211188",
         },
         {
            category: "self",
            summary: "SUSE Bug 1211190",
            url: "https://bugzilla.suse.com/1211190",
         },
         {
            category: "self",
            summary: "SUSE Bug 1218126",
            url: "https://bugzilla.suse.com/1218126",
         },
         {
            category: "self",
            summary: "SUSE Bug 1218186",
            url: "https://bugzilla.suse.com/1218186",
         },
         {
            category: "self",
            summary: "SUSE Bug 1218209",
            url: "https://bugzilla.suse.com/1218209",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-14889 page",
            url: "https://www.suse.com/security/cve/CVE-2019-14889/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-16135 page",
            url: "https://www.suse.com/security/cve/CVE-2020-16135/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-1730 page",
            url: "https://www.suse.com/security/cve/CVE-2020-1730/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-3634 page",
            url: "https://www.suse.com/security/cve/CVE-2021-3634/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2023-1667 page",
            url: "https://www.suse.com/security/cve/CVE-2023-1667/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2023-2283 page",
            url: "https://www.suse.com/security/cve/CVE-2023-2283/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2023-48795 page",
            url: "https://www.suse.com/security/cve/CVE-2023-48795/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2023-6004 page",
            url: "https://www.suse.com/security/cve/CVE-2023-6004/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2023-6918 page",
            url: "https://www.suse.com/security/cve/CVE-2023-6918/",
         },
      ],
      title: "Security update for libssh",
      tracking: {
         current_release_date: "2024-02-20T15:03:55Z",
         generator: {
            date: "2024-02-20T15:03:55Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2024:0539-1",
         initial_release_date: "2024-02-20T15:03:55Z",
         revision_history: [
            {
               date: "2024-02-20T15:03:55Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libssh-config-0.9.8-3.12.2.aarch64",
                        product: {
                           name: "libssh-config-0.9.8-3.12.2.aarch64",
                           product_id: "libssh-config-0.9.8-3.12.2.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh-devel-0.9.8-3.12.2.aarch64",
                        product: {
                           name: "libssh-devel-0.9.8-3.12.2.aarch64",
                           product_id: "libssh-devel-0.9.8-3.12.2.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh4-0.9.8-3.12.2.aarch64",
                        product: {
                           name: "libssh4-0.9.8-3.12.2.aarch64",
                           product_id: "libssh4-0.9.8-3.12.2.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libssh4-64bit-0.9.8-3.12.2.aarch64_ilp32",
                        product: {
                           name: "libssh4-64bit-0.9.8-3.12.2.aarch64_ilp32",
                           product_id: "libssh4-64bit-0.9.8-3.12.2.aarch64_ilp32",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64_ilp32",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libssh-config-0.9.8-3.12.2.i586",
                        product: {
                           name: "libssh-config-0.9.8-3.12.2.i586",
                           product_id: "libssh-config-0.9.8-3.12.2.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh-devel-0.9.8-3.12.2.i586",
                        product: {
                           name: "libssh-devel-0.9.8-3.12.2.i586",
                           product_id: "libssh-devel-0.9.8-3.12.2.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh4-0.9.8-3.12.2.i586",
                        product: {
                           name: "libssh4-0.9.8-3.12.2.i586",
                           product_id: "libssh4-0.9.8-3.12.2.i586",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "i586",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libssh-config-0.9.8-3.12.2.ppc64le",
                        product: {
                           name: "libssh-config-0.9.8-3.12.2.ppc64le",
                           product_id: "libssh-config-0.9.8-3.12.2.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh-devel-0.9.8-3.12.2.ppc64le",
                        product: {
                           name: "libssh-devel-0.9.8-3.12.2.ppc64le",
                           product_id: "libssh-devel-0.9.8-3.12.2.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh4-0.9.8-3.12.2.ppc64le",
                        product: {
                           name: "libssh4-0.9.8-3.12.2.ppc64le",
                           product_id: "libssh4-0.9.8-3.12.2.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libssh-config-0.9.8-3.12.2.s390",
                        product: {
                           name: "libssh-config-0.9.8-3.12.2.s390",
                           product_id: "libssh-config-0.9.8-3.12.2.s390",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh-devel-0.9.8-3.12.2.s390",
                        product: {
                           name: "libssh-devel-0.9.8-3.12.2.s390",
                           product_id: "libssh-devel-0.9.8-3.12.2.s390",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh4-0.9.8-3.12.2.s390",
                        product: {
                           name: "libssh4-0.9.8-3.12.2.s390",
                           product_id: "libssh4-0.9.8-3.12.2.s390",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libssh-config-0.9.8-3.12.2.s390x",
                        product: {
                           name: "libssh-config-0.9.8-3.12.2.s390x",
                           product_id: "libssh-config-0.9.8-3.12.2.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh-devel-0.9.8-3.12.2.s390x",
                        product: {
                           name: "libssh-devel-0.9.8-3.12.2.s390x",
                           product_id: "libssh-devel-0.9.8-3.12.2.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh4-0.9.8-3.12.2.s390x",
                        product: {
                           name: "libssh4-0.9.8-3.12.2.s390x",
                           product_id: "libssh4-0.9.8-3.12.2.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh4-32bit-0.9.8-3.12.2.s390x",
                        product: {
                           name: "libssh4-32bit-0.9.8-3.12.2.s390x",
                           product_id: "libssh4-32bit-0.9.8-3.12.2.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libssh-config-0.9.8-3.12.2.x86_64",
                        product: {
                           name: "libssh-config-0.9.8-3.12.2.x86_64",
                           product_id: "libssh-config-0.9.8-3.12.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh-devel-0.9.8-3.12.2.x86_64",
                        product: {
                           name: "libssh-devel-0.9.8-3.12.2.x86_64",
                           product_id: "libssh-devel-0.9.8-3.12.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh4-0.9.8-3.12.2.x86_64",
                        product: {
                           name: "libssh4-0.9.8-3.12.2.x86_64",
                           product_id: "libssh4-0.9.8-3.12.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libssh4-32bit-0.9.8-3.12.2.x86_64",
                        product: {
                           name: "libssh4-32bit-0.9.8-3.12.2.x86_64",
                           product_id: "libssh4-32bit-0.9.8-3.12.2.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Software Development Kit 12 SP5",
                        product: {
                           name: "SUSE Linux Enterprise Software Development Kit 12 SP5",
                           product_id: "SUSE Linux Enterprise Software Development Kit 12 SP5",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-sdk:12:sp5",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server 12 SP5",
                        product: {
                           name: "SUSE Linux Enterprise Server 12 SP5",
                           product_id: "SUSE Linux Enterprise Server 12 SP5",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles:12:sp5",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                        product: {
                           name: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                           product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles_sap:12:sp5",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh-devel-0.9.8-3.12.2.aarch64 as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
               product_id: "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
            },
            product_reference: "libssh-devel-0.9.8-3.12.2.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Software Development Kit 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh-devel-0.9.8-3.12.2.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
               product_id: "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
            },
            product_reference: "libssh-devel-0.9.8-3.12.2.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Software Development Kit 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh-devel-0.9.8-3.12.2.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
               product_id: "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
            },
            product_reference: "libssh-devel-0.9.8-3.12.2.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Software Development Kit 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh-devel-0.9.8-3.12.2.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
               product_id: "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
            },
            product_reference: "libssh-devel-0.9.8-3.12.2.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Software Development Kit 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-0.9.8-3.12.2.aarch64 as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
               product_id: "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
            },
            product_reference: "libssh4-0.9.8-3.12.2.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Software Development Kit 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-0.9.8-3.12.2.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
               product_id: "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
            },
            product_reference: "libssh4-0.9.8-3.12.2.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Software Development Kit 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-0.9.8-3.12.2.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
               product_id: "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
            },
            product_reference: "libssh4-0.9.8-3.12.2.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Software Development Kit 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-0.9.8-3.12.2.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
               product_id: "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
            },
            product_reference: "libssh4-0.9.8-3.12.2.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Software Development Kit 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh-config-0.9.8-3.12.2.aarch64 as component of SUSE Linux Enterprise Server 12 SP5",
               product_id: "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
            },
            product_reference: "libssh-config-0.9.8-3.12.2.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh-config-0.9.8-3.12.2.ppc64le as component of SUSE Linux Enterprise Server 12 SP5",
               product_id: "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
            },
            product_reference: "libssh-config-0.9.8-3.12.2.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh-config-0.9.8-3.12.2.s390x as component of SUSE Linux Enterprise Server 12 SP5",
               product_id: "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
            },
            product_reference: "libssh-config-0.9.8-3.12.2.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh-config-0.9.8-3.12.2.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
               product_id: "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
            },
            product_reference: "libssh-config-0.9.8-3.12.2.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-0.9.8-3.12.2.aarch64 as component of SUSE Linux Enterprise Server 12 SP5",
               product_id: "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
            },
            product_reference: "libssh4-0.9.8-3.12.2.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-0.9.8-3.12.2.ppc64le as component of SUSE Linux Enterprise Server 12 SP5",
               product_id: "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
            },
            product_reference: "libssh4-0.9.8-3.12.2.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-0.9.8-3.12.2.s390x as component of SUSE Linux Enterprise Server 12 SP5",
               product_id: "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
            },
            product_reference: "libssh4-0.9.8-3.12.2.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-0.9.8-3.12.2.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
               product_id: "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
            },
            product_reference: "libssh4-0.9.8-3.12.2.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-32bit-0.9.8-3.12.2.s390x as component of SUSE Linux Enterprise Server 12 SP5",
               product_id: "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
            },
            product_reference: "libssh4-32bit-0.9.8-3.12.2.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-32bit-0.9.8-3.12.2.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
               product_id: "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
            },
            product_reference: "libssh4-32bit-0.9.8-3.12.2.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh-config-0.9.8-3.12.2.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
            },
            product_reference: "libssh-config-0.9.8-3.12.2.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh-config-0.9.8-3.12.2.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
            },
            product_reference: "libssh-config-0.9.8-3.12.2.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh-config-0.9.8-3.12.2.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
            },
            product_reference: "libssh-config-0.9.8-3.12.2.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh-config-0.9.8-3.12.2.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
            },
            product_reference: "libssh-config-0.9.8-3.12.2.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-0.9.8-3.12.2.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
            },
            product_reference: "libssh4-0.9.8-3.12.2.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-0.9.8-3.12.2.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
            },
            product_reference: "libssh4-0.9.8-3.12.2.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-0.9.8-3.12.2.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
            },
            product_reference: "libssh4-0.9.8-3.12.2.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-0.9.8-3.12.2.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
            },
            product_reference: "libssh4-0.9.8-3.12.2.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-32bit-0.9.8-3.12.2.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
            },
            product_reference: "libssh4-32bit-0.9.8-3.12.2.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libssh4-32bit-0.9.8-3.12.2.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
            },
            product_reference: "libssh4-32bit-0.9.8-3.12.2.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2019-14889",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-14889",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-14889",
               url: "https://www.suse.com/security/cve/CVE-2019-14889",
            },
            {
               category: "external",
               summary: "SUSE Bug 1158095 for CVE-2019-14889",
               url: "https://bugzilla.suse.com/1158095",
            },
            {
               category: "external",
               summary: "SUSE Bug 1224871 for CVE-2019-14889",
               url: "https://bugzilla.suse.com/1224871",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-02-20T15:03:55Z",
               details: "important",
            },
         ],
         title: "CVE-2019-14889",
      },
      {
         cve: "CVE-2020-16135",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-16135",
            },
         ],
         notes: [
            {
               category: "general",
               text: "libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-16135",
               url: "https://www.suse.com/security/cve/CVE-2020-16135",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174713 for CVE-2020-16135",
               url: "https://bugzilla.suse.com/1174713",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-02-20T15:03:55Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-16135",
      },
      {
         cve: "CVE-2020-1730",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-1730",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-1730",
               url: "https://www.suse.com/security/cve/CVE-2020-1730",
            },
            {
               category: "external",
               summary: "SUSE Bug 1168699 for CVE-2020-1730",
               url: "https://bugzilla.suse.com/1168699",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-02-20T15:03:55Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-1730",
      },
      {
         cve: "CVE-2021-3634",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-3634",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other session_id. Initially, both of them are the same, but after key re-exchange, previous session_id is kept and used as an input to new secret_hash. Historically, both of these buffers had shared length variable, which worked as long as these buffers were same. But the key re-exchange operation can also change the key exchange method, which can be based on hash of different size, eventually creating \"secret_hash\" of different size than the session_id has. This becomes an issue when the session_id memory is zeroed or when it is used again during second key re-exchange.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-3634",
               url: "https://www.suse.com/security/cve/CVE-2021-3634",
            },
            {
               category: "external",
               summary: "SUSE Bug 1189608 for CVE-2021-3634",
               url: "https://bugzilla.suse.com/1189608",
            },
            {
               category: "external",
               summary: "SUSE Bug 1194948 for CVE-2021-3634",
               url: "https://bugzilla.suse.com/1194948",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 3.5,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-02-20T15:03:55Z",
               details: "low",
            },
         ],
         title: "CVE-2021-3634",
      },
      {
         cve: "CVE-2023-1667",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2023-1667",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2023-1667",
               url: "https://www.suse.com/security/cve/CVE-2023-1667",
            },
            {
               category: "external",
               summary: "SUSE Bug 1211188 for CVE-2023-1667",
               url: "https://bugzilla.suse.com/1211188",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-02-20T15:03:55Z",
               details: "moderate",
            },
         ],
         title: "CVE-2023-1667",
      },
      {
         cve: "CVE-2023-2283",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2023-2283",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2023-2283",
               url: "https://www.suse.com/security/cve/CVE-2023-2283",
            },
            {
               category: "external",
               summary: "SUSE Bug 1211190 for CVE-2023-2283",
               url: "https://bugzilla.suse.com/1211190",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.8,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-02-20T15:03:55Z",
               details: "moderate",
            },
         ],
         title: "CVE-2023-2283",
      },
      {
         cve: "CVE-2023-48795",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2023-48795",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2023-48795",
               url: "https://www.suse.com/security/cve/CVE-2023-48795",
            },
            {
               category: "external",
               summary: "SUSE Bug 1217950 for CVE-2023-48795",
               url: "https://bugzilla.suse.com/1217950",
            },
            {
               category: "external",
               summary: "SUSE Bug 1218708 for CVE-2023-48795",
               url: "https://bugzilla.suse.com/1218708",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-02-20T15:03:55Z",
               details: "important",
            },
         ],
         title: "CVE-2023-48795",
      },
      {
         cve: "CVE-2023-6004",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2023-6004",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2023-6004",
               url: "https://www.suse.com/security/cve/CVE-2023-6004",
            },
            {
               category: "external",
               summary: "SUSE Bug 1218209 for CVE-2023-6004",
               url: "https://bugzilla.suse.com/1218209",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.8,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-02-20T15:03:55Z",
               details: "moderate",
            },
         ],
         title: "CVE-2023-6004",
      },
      {
         cve: "CVE-2023-6918",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2023-6918",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2023-6918",
               url: "https://www.suse.com/security/cve/CVE-2023-6918",
            },
            {
               category: "external",
               summary: "SUSE Bug 1218186 for CVE-2023-6918",
               url: "https://bugzilla.suse.com/1218186",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh-config-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libssh4-32bit-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh-devel-0.9.8-3.12.2.x86_64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.aarch64",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP5:libssh4-0.9.8-3.12.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-02-20T15:03:55Z",
               details: "important",
            },
         ],
         title: "CVE-2023-6918",
      },
   ],
}

cve-2023-6004

Vulnerability from cvelistv5

Published

2024-01-03 17:01

Modified

2024-11-24 12:54

Severity ?

4.8 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Summary

A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2024:2504	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:3233	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2023-6004	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2251110	issue-tracking, x_refsource_REDHAT
	https://www.libssh.org/security/advisories/CVE-2023-6004.txt

Impacted products

Vendor

Product

Version

▼

Red Hat

Red Hat Enterprise Linux 8

Unaffected: 0:0.9.6-14.el8   < *
    cpe:/a:redhat:enterprise_linux:8::appstream
    cpe:/o:redhat:enterprise_linux:8::baseos

Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:0.9.6-14.el8 < * cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:0.10.4-13.el9 < * cpe:/o:redhat:enterprise_linux:9::baseos cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:0.10.4-13.el9 < * cpe:/o:redhat:enterprise_linux:9::baseos cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T08:14:25.140Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2024:2504",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:2504",
               },
               {
                  name: "RHSA-2024:3233",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:3233",
               },
               {
                  tags: [
                     "vdb-entry",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2023-6004",
               },
               {
                  name: "RHBZ#2251110",
                  tags: [
                     "issue-tracking",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2251110",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20240223-0004/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.libssh.org/security/advisories/CVE-2023-6004.txt",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:8::appstream",
                  "cpe:/o:redhat:enterprise_linux:8::baseos",
               ],
               defaultStatus: "affected",
               packageName: "libssh",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:0.9.6-14.el8",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:8::appstream",
                  "cpe:/o:redhat:enterprise_linux:8::baseos",
               ],
               defaultStatus: "affected",
               packageName: "libssh",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:0.9.6-14.el8",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9::baseos",
                  "cpe:/a:redhat:enterprise_linux:9::appstream",
               ],
               defaultStatus: "affected",
               packageName: "libssh",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:0.10.4-13.el9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9::baseos",
                  "cpe:/a:redhat:enterprise_linux:9::appstream",
               ],
               defaultStatus: "affected",
               packageName: "libssh",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:0.10.4-13.el9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:7",
               ],
               defaultStatus: "unknown",
               packageName: "libssh",
               product: "Red Hat Enterprise Linux 7",
               vendor: "Red Hat",
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Red Hat would like to thank Norbert Pocs (libssh) and vinci@protonmail.ch for reporting this issue.",
            },
         ],
         datePublic: "2023-12-18T00:00:00+00:00",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Low",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "LOW",
                  baseScore: 4.8,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-74",
                     description: "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-24T12:54:16.729Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2024:2504",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:2504",
            },
            {
               name: "RHSA-2024:3233",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:3233",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2023-6004",
            },
            {
               name: "RHBZ#2251110",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2251110",
            },
            {
               url: "https://www.libssh.org/security/advisories/CVE-2023-6004.txt",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2023-11-22T00:00:00+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2023-12-18T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname",
         workarounds: [
            {
               lang: "en",
               value: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
            },
         ],
         x_redhatCweChain: "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2023-6004",
      datePublished: "2024-01-03T17:01:38.672Z",
      dateReserved: "2023-11-07T23:07:50.073Z",
      dateUpdated: "2024-11-24T12:54:16.729Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-3634

Vulnerability from cvelistv5

Published

2021-08-31 00:00

Modified

2024-08-03 17:01

Severity ?

Summary

A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other session_id. Initially, both of them are the same, but after key re-exchange, previous session_id is kept and used as an input to new secret_hash. Historically, both of these buffers had shared length variable, which worked as long as these buffers were same. But the key re-exchange operation can also change the key exchange method, which can be based on hash of different size, eventually creating "secret_hash" of different size than the session_id has. This becomes an issue when the session_id memory is zeroed or when it is used again during second key re-exchange.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=1978810
	https://www.debian.org/security/2021/dsa-4965	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVWAAB2XMKEUMPMDALINKAA4U2QM4LNG/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKYD3ZRAMDAQX3ZW6THHUF3GXN7FF6B4/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRK67AJCWYYVAGF5SGAHNZXCX3PN3ZFP/	vendor-advisory
	https://www.oracle.com/security-alerts/cpujan2022.html
	https://security.netapp.com/advisory/ntap-20211004-0003/
	https://security.gentoo.org/glsa/202312-05	vendor-advisory

Impacted products

	Vendor	Product	Version
	n/a	libssh	Version: libssh 0.9.6

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T17:01:07.562Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1978810",
               },
               {
                  name: "DSA-4965",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-4965",
               },
               {
                  name: "FEDORA-2021-ec797b6a96",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVWAAB2XMKEUMPMDALINKAA4U2QM4LNG/",
               },
               {
                  name: "FEDORA-2021-288925ac19",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKYD3ZRAMDAQX3ZW6THHUF3GXN7FF6B4/",
               },
               {
                  name: "FEDORA-2021-f2a020a065",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRK67AJCWYYVAGF5SGAHNZXCX3PN3ZFP/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211004-0003/",
               },
               {
                  name: "GLSA-202312-05",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-05",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "libssh",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "libssh 0.9.6",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other session_id. Initially, both of them are the same, but after key re-exchange, previous session_id is kept and used as an input to new secret_hash. Historically, both of these buffers had shared length variable, which worked as long as these buffers were same. But the key re-exchange operation can also change the key exchange method, which can be based on hash of different size, eventually creating \"secret_hash\" of different size than the session_id has. This becomes an issue when the session_id memory is zeroed or when it is used again during second key re-exchange.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-12-22T10:06:14.732204",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1978810",
            },
            {
               name: "DSA-4965",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2021/dsa-4965",
            },
            {
               name: "FEDORA-2021-ec797b6a96",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVWAAB2XMKEUMPMDALINKAA4U2QM4LNG/",
            },
            {
               name: "FEDORA-2021-288925ac19",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKYD3ZRAMDAQX3ZW6THHUF3GXN7FF6B4/",
            },
            {
               name: "FEDORA-2021-f2a020a065",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRK67AJCWYYVAGF5SGAHNZXCX3PN3ZFP/",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20211004-0003/",
            },
            {
               name: "GLSA-202312-05",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-05",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2021-3634",
      datePublished: "2021-08-31T00:00:00",
      dateReserved: "2021-07-02T00:00:00",
      dateUpdated: "2024-08-03T17:01:07.562Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2019-14889

Vulnerability from cvelistv5

Published

2019-12-10 00:00

Modified

2024-08-05 00:26

Severity ?

7.1 (High) - CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Summary

A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.

References

▼	URL	Tags
	https://usn.ubuntu.com/4219-1/	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00033.html	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2019/12/msg00020.html	mailing-list
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JJWJTXVWLLJTVHBPGWL7472S5FWXYQR/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EV2ONSPDJCTDVORCB4UGRQUZQQ46JHRN/	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00047.html	vendor-advisory
	https://security.gentoo.org/glsa/202003-27	vendor-advisory
	https://www.oracle.com/security-alerts/cpuapr2020.html
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14889
	https://www.libssh.org/security/advisories/CVE-2019-14889.txt
	https://lists.debian.org/debian-lts-announce/2023/05/msg00029.html	mailing-list

Impacted products

	Vendor	Product	Version
	Red Hat	libssh	Version: All libssh versions before 0.9.3 Version: All libssh versions before 0.8.8

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T00:26:39.148Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "USN-4219-1",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/4219-1/",
               },
               {
                  name: "openSUSE-SU-2019:2689",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00033.html",
               },
               {
                  name: "[debian-lts-announce] 20191217 [SECURITY] [DLA 2038-1] libssh security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2019/12/msg00020.html",
               },
               {
                  name: "FEDORA-2019-8b0ad69829",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JJWJTXVWLLJTVHBPGWL7472S5FWXYQR/",
               },
               {
                  name: "FEDORA-2019-46b6bd2459",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EV2ONSPDJCTDVORCB4UGRQUZQQ46JHRN/",
               },
               {
                  name: "openSUSE-SU-2020:0102",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00047.html",
               },
               {
                  name: "GLSA-202003-27",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202003-27",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2020.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14889",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.libssh.org/security/advisories/CVE-2019-14889.txt",
               },
               {
                  name: "[debian-lts-announce] 20230529 [SECURITY] [DLA 3437-1] libssh security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2023/05/msg00029.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "libssh",
               vendor: "Red Hat",
               versions: [
                  {
                     status: "affected",
                     version: "All libssh versions before 0.9.3",
                  },
                  {
                     status: "affected",
                     version: "All libssh versions before 0.8.8",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-78",
                     description: "CWE-78",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-05-29T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "USN-4219-1",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://usn.ubuntu.com/4219-1/",
            },
            {
               name: "openSUSE-SU-2019:2689",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00033.html",
            },
            {
               name: "[debian-lts-announce] 20191217 [SECURITY] [DLA 2038-1] libssh security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2019/12/msg00020.html",
            },
            {
               name: "FEDORA-2019-8b0ad69829",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JJWJTXVWLLJTVHBPGWL7472S5FWXYQR/",
            },
            {
               name: "FEDORA-2019-46b6bd2459",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EV2ONSPDJCTDVORCB4UGRQUZQQ46JHRN/",
            },
            {
               name: "openSUSE-SU-2020:0102",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00047.html",
            },
            {
               name: "GLSA-202003-27",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202003-27",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpuapr2020.html",
            },
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14889",
            },
            {
               url: "https://www.libssh.org/security/advisories/CVE-2019-14889.txt",
            },
            {
               name: "[debian-lts-announce] 20230529 [SECURITY] [DLA 3437-1] libssh security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2023/05/msg00029.html",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2019-14889",
      datePublished: "2019-12-10T00:00:00",
      dateReserved: "2019-08-10T00:00:00",
      dateUpdated: "2024-08-05T00:26:39.148Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-16135

Vulnerability from cvelistv5

Published

2020-07-29 20:20

Modified

2024-08-04 13:37

Severity ?

Summary

libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.

References

▼	URL	Tags
	https://bugs.libssh.org/T232	x_refsource_MISC
	https://bugs.libssh.org/rLIBSSHe631ebb3e2247dd25e9678e6827c20dc73b73238	x_refsource_MISC
	https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2020/07/msg00034.html	mailing-list, x_refsource_MLIST
	https://usn.ubuntu.com/4447-1/	vendor-advisory, x_refsource_UBUNTU
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JNW5GBC6JFN76VEWQXMLT5F7VCZ5AJ2E/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCIKQRKXAAB4HMWM62EPZJ4DVBHIIEG6/	vendor-advisory, x_refsource_FEDORA
	https://security.gentoo.org/glsa/202011-05	vendor-advisory, x_refsource_GENTOO
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T13:37:53.390Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugs.libssh.org/T232",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugs.libssh.org/rLIBSSHe631ebb3e2247dd25e9678e6827c20dc73b73238",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120",
               },
               {
                  name: "[debian-lts-announce] 20200731 [SECURITY] [DLA 2303-1] libssh security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/07/msg00034.html",
               },
               {
                  name: "USN-4447-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/4447-1/",
               },
               {
                  name: "FEDORA-2020-f4f5e49cb8",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JNW5GBC6JFN76VEWQXMLT5F7VCZ5AJ2E/",
               },
               {
                  name: "FEDORA-2020-ac3e29073f",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCIKQRKXAAB4HMWM62EPZJ4DVBHIIEG6/",
               },
               {
                  name: "GLSA-202011-05",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202011-05",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-04-19T23:21:47",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugs.libssh.org/T232",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugs.libssh.org/rLIBSSHe631ebb3e2247dd25e9678e6827c20dc73b73238",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120",
            },
            {
               name: "[debian-lts-announce] 20200731 [SECURITY] [DLA 2303-1] libssh security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/07/msg00034.html",
            },
            {
               name: "USN-4447-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/4447-1/",
            },
            {
               name: "FEDORA-2020-f4f5e49cb8",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JNW5GBC6JFN76VEWQXMLT5F7VCZ5AJ2E/",
            },
            {
               name: "FEDORA-2020-ac3e29073f",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCIKQRKXAAB4HMWM62EPZJ4DVBHIIEG6/",
            },
            {
               name: "GLSA-202011-05",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202011-05",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2020-16135",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugs.libssh.org/T232",
                     refsource: "MISC",
                     url: "https://bugs.libssh.org/T232",
                  },
                  {
                     name: "https://bugs.libssh.org/rLIBSSHe631ebb3e2247dd25e9678e6827c20dc73b73238",
                     refsource: "MISC",
                     url: "https://bugs.libssh.org/rLIBSSHe631ebb3e2247dd25e9678e6827c20dc73b73238",
                  },
                  {
                     name: "https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120",
                     refsource: "MISC",
                     url: "https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120",
                  },
                  {
                     name: "[debian-lts-announce] 20200731 [SECURITY] [DLA 2303-1] libssh security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2020/07/msg00034.html",
                  },
                  {
                     name: "USN-4447-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/4447-1/",
                  },
                  {
                     name: "FEDORA-2020-f4f5e49cb8",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JNW5GBC6JFN76VEWQXMLT5F7VCZ5AJ2E/",
                  },
                  {
                     name: "FEDORA-2020-ac3e29073f",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FCIKQRKXAAB4HMWM62EPZJ4DVBHIIEG6/",
                  },
                  {
                     name: "GLSA-202011-05",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202011-05",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2020-16135",
      datePublished: "2020-07-29T20:20:29",
      dateReserved: "2020-07-29T00:00:00",
      dateUpdated: "2024-08-04T13:37:53.390Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-48795

Vulnerability from cvelistv5

Published

2023-12-18 00:00

Modified

2024-08-02 21:46

Severity ?

Summary

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.

References

▼	URL	Tags
	https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
	https://matt.ucc.asn.au/dropbear/CHANGES
	https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES
	https://www.netsarang.com/en/xshell-update-history/
	https://www.paramiko.org/changelog.html
	https://www.openssh.com/openbsd.html
	https://github.com/openssh/openssh-portable/commits/master
	https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ
	https://www.bitvise.com/ssh-server-version-history
	https://github.com/ronf/asyncssh/tags
	https://gitlab.com/libssh/libssh-mirror/-/tags
	https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed/
	https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42
	https://www.openssh.com/txt/release-9.6
	https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795/
	https://www.terrapin-attack.com
	https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25
	https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst
	https://thorntech.com/cve-2023-48795-and-sftp-gateway/
	https://github.com/warp-tech/russh/releases/tag/v0.40.2
	https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0
	https://www.openwall.com/lists/oss-security/2023/12/18/2
	https://twitter.com/TrueSkrillor/status/1736774389725565005
	https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d
	https://github.com/paramiko/paramiko/issues/2337
	https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg
	https://news.ycombinator.com/item?id=38684904
	https://news.ycombinator.com/item?id=38685286
	http://www.openwall.com/lists/oss-security/2023/12/18/3	mailing-list
	https://github.com/mwiede/jsch/issues/457
	https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10&id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6
	https://github.com/erlang/otp/releases/tag/OTP-26.2.1
	https://github.com/advisories/GHSA-45x7-px36-x8w8
	https://security-tracker.debian.org/tracker/source-package/libssh2
	https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg
	https://security-tracker.debian.org/tracker/CVE-2023-48795
	https://bugzilla.suse.com/show_bug.cgi?id=1217950
	https://bugzilla.redhat.com/show_bug.cgi?id=2254210
	https://bugs.gentoo.org/920280
	https://ubuntu.com/security/CVE-2023-48795
	https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795/
	https://access.redhat.com/security/cve/cve-2023-48795
	https://github.com/mwiede/jsch/pull/461
	https://github.com/drakkan/sftpgo/releases/tag/v2.5.6
	https://github.com/libssh2/libssh2/pull/1291
	https://forum.netgate.com/topic/184941/terrapin-ssh-attack
	https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5
	https://github.com/rapier1/hpn-ssh/releases
	https://github.com/proftpd/proftpd/issues/456
	https://github.com/TeraTermProject/teraterm/releases/tag/v5.1
	https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15
	https://oryx-embedded.com/download/#changelog
	https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update
	https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22
	https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab
	https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3
	https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC
	https://crates.io/crates/thrussh/versions
	https://github.com/NixOS/nixpkgs/pull/275249
	http://www.openwall.com/lists/oss-security/2023/12/19/5	mailing-list
	https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc
	https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/
	http://www.openwall.com/lists/oss-security/2023/12/20/3	mailing-list
	http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html
	https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES
	https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES
	https://github.com/apache/mina-sshd/issues/445
	https://github.com/hierynomus/sshj/issues/916
	https://github.com/janmojzis/tinyssh/issues/81
	https://www.openwall.com/lists/oss-security/2023/12/20/3
	https://security-tracker.debian.org/tracker/source-package/trilead-ssh2
	https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/	vendor-advisory
	https://www.debian.org/security/2023/dsa-5586	vendor-advisory
	https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508
	https://www.theregister.com/2023/12/20/terrapin_attack_ssh
	https://filezilla-project.org/versions.php
	https://nova.app/releases/#v11.8
	https://roumenpetrov.info/secsh/#news20231220
	https://www.vandyke.com/products/securecrt/history.txt
	https://help.panic.com/releasenotes/transmit5/
	https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta
	https://github.com/PowerShell/Win32-OpenSSH/issues/2189
	https://winscp.net/eng/docs/history#6.2.2
	https://www.bitvise.com/ssh-client-version-history#933
	https://github.com/cyd01/KiTTY/issues/520
	https://www.debian.org/security/2023/dsa-5588	vendor-advisory
	https://github.com/ssh-mitm/ssh-mitm/issues/165
	https://news.ycombinator.com/item?id=38732005
	https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html	mailing-list
	https://security.gentoo.org/glsa/202312-16	vendor-advisory
	https://security.gentoo.org/glsa/202312-17	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD/	vendor-advisory
	https://security.netapp.com/advisory/ntap-20240105-0004/
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/	vendor-advisory
	https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html	mailing-list
	https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html	mailing-list
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/	vendor-advisory
	https://support.apple.com/kb/HT214084
	http://seclists.org/fulldisclosure/2024/Mar/21	mailing-list
	https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html	mailing-list
	http://www.openwall.com/lists/oss-security/2024/04/17/8	mailing-list
	http://www.openwall.com/lists/oss-security/2024/03/06/3	mailing-list

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T21:46:27.255Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://matt.ucc.asn.au/dropbear/CHANGES",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.netsarang.com/en/xshell-update-history/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.paramiko.org/changelog.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.openssh.com/openbsd.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/openssh/openssh-portable/commits/master",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.bitvise.com/ssh-server-version-history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/ronf/asyncssh/tags",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://gitlab.com/libssh/libssh-mirror/-/tags",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.openssh.com/txt/release-9.6",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.terrapin-attack.com",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://thorntech.com/cve-2023-48795-and-sftp-gateway/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/warp-tech/russh/releases/tag/v0.40.2",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.openwall.com/lists/oss-security/2023/12/18/2",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://twitter.com/TrueSkrillor/status/1736774389725565005",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/paramiko/paramiko/issues/2337",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://news.ycombinator.com/item?id=38684904",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://news.ycombinator.com/item?id=38685286",
               },
               {
                  name: "[oss-security] 20231218 CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2023/12/18/3",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/mwiede/jsch/issues/457",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10&id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/erlang/otp/releases/tag/OTP-26.2.1",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/advisories/GHSA-45x7-px36-x8w8",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security-tracker.debian.org/tracker/source-package/libssh2",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security-tracker.debian.org/tracker/CVE-2023-48795",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.suse.com/show_bug.cgi?id=1217950",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2254210",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugs.gentoo.org/920280",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://ubuntu.com/security/CVE-2023-48795",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/cve-2023-48795",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/mwiede/jsch/pull/461",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/drakkan/sftpgo/releases/tag/v2.5.6",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/libssh2/libssh2/pull/1291",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://forum.netgate.com/topic/184941/terrapin-ssh-attack",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/rapier1/hpn-ssh/releases",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/proftpd/proftpd/issues/456",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/TeraTermProject/teraterm/releases/tag/v5.1",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://oryx-embedded.com/download/#changelog",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://crates.io/crates/thrussh/versions",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/NixOS/nixpkgs/pull/275249",
               },
               {
                  name: "[oss-security] 20231219 Re: CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2023/12/19/5",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/",
               },
               {
                  name: "[oss-security] 20231220 Re: CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2023/12/20/3",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/apache/mina-sshd/issues/445",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/hierynomus/sshj/issues/916",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/janmojzis/tinyssh/issues/81",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.openwall.com/lists/oss-security/2023/12/20/3",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security-tracker.debian.org/tracker/source-package/trilead-ssh2",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16",
               },
               {
                  name: "FEDORA-2023-0733306be9",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/",
               },
               {
                  name: "DSA-5586",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2023/dsa-5586",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.theregister.com/2023/12/20/terrapin_attack_ssh",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://filezilla-project.org/versions.php",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://nova.app/releases/#v11.8",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://roumenpetrov.info/secsh/#news20231220",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.vandyke.com/products/securecrt/history.txt",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://help.panic.com/releasenotes/transmit5/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/PowerShell/Win32-OpenSSH/issues/2189",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://winscp.net/eng/docs/history#6.2.2",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.bitvise.com/ssh-client-version-history#933",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/cyd01/KiTTY/issues/520",
               },
               {
                  name: "DSA-5588",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2023/dsa-5588",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/ssh-mitm/ssh-mitm/issues/165",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://news.ycombinator.com/item?id=38732005",
               },
               {
                  name: "[debian-lts-announce] 20231226 [SECURITY] [DLA 3694-1] openssh security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html",
               },
               {
                  name: "GLSA-202312-16",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-16",
               },
               {
                  name: "GLSA-202312-17",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-17",
               },
               {
                  name: "FEDORA-2023-20feb865d8",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/",
               },
               {
                  name: "FEDORA-2023-cb8c606fbb",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y/",
               },
               {
                  name: "FEDORA-2023-e77300e4b5",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/",
               },
               {
                  name: "FEDORA-2023-b87ec6cf47",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7/",
               },
               {
                  name: "FEDORA-2023-153404713b",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20240105-0004/",
               },
               {
                  name: "FEDORA-2024-3bb23c77f3",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS/",
               },
               {
                  name: "FEDORA-2023-55800423a8",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/",
               },
               {
                  name: "FEDORA-2024-d946b9ad25",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/",
               },
               {
                  name: "FEDORA-2024-71c2c6526c",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6/",
               },
               {
                  name: "FEDORA-2024-39a8c72ea9",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002",
               },
               {
                  name: "FEDORA-2024-ae653fb07b",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/",
               },
               {
                  name: "FEDORA-2024-2705241461",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/",
               },
               {
                  name: "FEDORA-2024-fb32950d11",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/",
               },
               {
                  name: "FEDORA-2024-7b08207cdb",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/",
               },
               {
                  name: "FEDORA-2024-06ebb70bdd",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/",
               },
               {
                  name: "[debian-lts-announce] 20240125 [SECURITY] [DLA 3718-1] php-phpseclib security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html",
               },
               {
                  name: "[debian-lts-announce] 20240125 [SECURITY] [DLA 3719-1] phpseclib security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html",
               },
               {
                  name: "FEDORA-2024-a53b24023d",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/",
               },
               {
                  name: "FEDORA-2024-3fd1bc9276",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.apple.com/kb/HT214084",
               },
               {
                  name: "20240313 APPLE-SA-03-07-2024-2 macOS Sonoma 14.4",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2024/Mar/21",
               },
               {
                  name: "[debian-lts-announce] 20240425 [SECURITY] [DLA 3794-1] putty security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html",
               },
               {
                  name: "[oss-security] 20240417 Terrapin vulnerability in Jenkins CLI client",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2024/04/17/8",
               },
               {
                  name: "[oss-security] 20240306 Multiple vulnerabilities in Jenkins plugins",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2024/03/06/3",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-05-01T18:06:23.972272",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               url: "https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html",
            },
            {
               url: "https://matt.ucc.asn.au/dropbear/CHANGES",
            },
            {
               url: "https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES",
            },
            {
               url: "https://www.netsarang.com/en/xshell-update-history/",
            },
            {
               url: "https://www.paramiko.org/changelog.html",
            },
            {
               url: "https://www.openssh.com/openbsd.html",
            },
            {
               url: "https://github.com/openssh/openssh-portable/commits/master",
            },
            {
               url: "https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ",
            },
            {
               url: "https://www.bitvise.com/ssh-server-version-history",
            },
            {
               url: "https://github.com/ronf/asyncssh/tags",
            },
            {
               url: "https://gitlab.com/libssh/libssh-mirror/-/tags",
            },
            {
               url: "https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed/",
            },
            {
               url: "https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42",
            },
            {
               url: "https://www.openssh.com/txt/release-9.6",
            },
            {
               url: "https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795/",
            },
            {
               url: "https://www.terrapin-attack.com",
            },
            {
               url: "https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25",
            },
            {
               url: "https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst",
            },
            {
               url: "https://thorntech.com/cve-2023-48795-and-sftp-gateway/",
            },
            {
               url: "https://github.com/warp-tech/russh/releases/tag/v0.40.2",
            },
            {
               url: "https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0",
            },
            {
               url: "https://www.openwall.com/lists/oss-security/2023/12/18/2",
            },
            {
               url: "https://twitter.com/TrueSkrillor/status/1736774389725565005",
            },
            {
               url: "https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d",
            },
            {
               url: "https://github.com/paramiko/paramiko/issues/2337",
            },
            {
               url: "https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg",
            },
            {
               url: "https://news.ycombinator.com/item?id=38684904",
            },
            {
               url: "https://news.ycombinator.com/item?id=38685286",
            },
            {
               name: "[oss-security] 20231218 CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2023/12/18/3",
            },
            {
               url: "https://github.com/mwiede/jsch/issues/457",
            },
            {
               url: "https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10&id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6",
            },
            {
               url: "https://github.com/erlang/otp/releases/tag/OTP-26.2.1",
            },
            {
               url: "https://github.com/advisories/GHSA-45x7-px36-x8w8",
            },
            {
               url: "https://security-tracker.debian.org/tracker/source-package/libssh2",
            },
            {
               url: "https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg",
            },
            {
               url: "https://security-tracker.debian.org/tracker/CVE-2023-48795",
            },
            {
               url: "https://bugzilla.suse.com/show_bug.cgi?id=1217950",
            },
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2254210",
            },
            {
               url: "https://bugs.gentoo.org/920280",
            },
            {
               url: "https://ubuntu.com/security/CVE-2023-48795",
            },
            {
               url: "https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795/",
            },
            {
               url: "https://access.redhat.com/security/cve/cve-2023-48795",
            },
            {
               url: "https://github.com/mwiede/jsch/pull/461",
            },
            {
               url: "https://github.com/drakkan/sftpgo/releases/tag/v2.5.6",
            },
            {
               url: "https://github.com/libssh2/libssh2/pull/1291",
            },
            {
               url: "https://forum.netgate.com/topic/184941/terrapin-ssh-attack",
            },
            {
               url: "https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5",
            },
            {
               url: "https://github.com/rapier1/hpn-ssh/releases",
            },
            {
               url: "https://github.com/proftpd/proftpd/issues/456",
            },
            {
               url: "https://github.com/TeraTermProject/teraterm/releases/tag/v5.1",
            },
            {
               url: "https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15",
            },
            {
               url: "https://oryx-embedded.com/download/#changelog",
            },
            {
               url: "https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update",
            },
            {
               url: "https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22",
            },
            {
               url: "https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab",
            },
            {
               url: "https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3",
            },
            {
               url: "https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC",
            },
            {
               url: "https://crates.io/crates/thrussh/versions",
            },
            {
               url: "https://github.com/NixOS/nixpkgs/pull/275249",
            },
            {
               name: "[oss-security] 20231219 Re: CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2023/12/19/5",
            },
            {
               url: "https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc",
            },
            {
               url: "https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/",
            },
            {
               name: "[oss-security] 20231220 Re: CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2023/12/20/3",
            },
            {
               url: "http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html",
            },
            {
               url: "https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES",
            },
            {
               url: "https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES",
            },
            {
               url: "https://github.com/apache/mina-sshd/issues/445",
            },
            {
               url: "https://github.com/hierynomus/sshj/issues/916",
            },
            {
               url: "https://github.com/janmojzis/tinyssh/issues/81",
            },
            {
               url: "https://www.openwall.com/lists/oss-security/2023/12/20/3",
            },
            {
               url: "https://security-tracker.debian.org/tracker/source-package/trilead-ssh2",
            },
            {
               url: "https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16",
            },
            {
               name: "FEDORA-2023-0733306be9",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/",
            },
            {
               name: "DSA-5586",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2023/dsa-5586",
            },
            {
               url: "https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508",
            },
            {
               url: "https://www.theregister.com/2023/12/20/terrapin_attack_ssh",
            },
            {
               url: "https://filezilla-project.org/versions.php",
            },
            {
               url: "https://nova.app/releases/#v11.8",
            },
            {
               url: "https://roumenpetrov.info/secsh/#news20231220",
            },
            {
               url: "https://www.vandyke.com/products/securecrt/history.txt",
            },
            {
               url: "https://help.panic.com/releasenotes/transmit5/",
            },
            {
               url: "https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta",
            },
            {
               url: "https://github.com/PowerShell/Win32-OpenSSH/issues/2189",
            },
            {
               url: "https://winscp.net/eng/docs/history#6.2.2",
            },
            {
               url: "https://www.bitvise.com/ssh-client-version-history#933",
            },
            {
               url: "https://github.com/cyd01/KiTTY/issues/520",
            },
            {
               name: "DSA-5588",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2023/dsa-5588",
            },
            {
               url: "https://github.com/ssh-mitm/ssh-mitm/issues/165",
            },
            {
               url: "https://news.ycombinator.com/item?id=38732005",
            },
            {
               name: "[debian-lts-announce] 20231226 [SECURITY] [DLA 3694-1] openssh security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html",
            },
            {
               name: "GLSA-202312-16",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-16",
            },
            {
               name: "GLSA-202312-17",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-17",
            },
            {
               name: "FEDORA-2023-20feb865d8",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/",
            },
            {
               name: "FEDORA-2023-cb8c606fbb",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y/",
            },
            {
               name: "FEDORA-2023-e77300e4b5",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/",
            },
            {
               name: "FEDORA-2023-b87ec6cf47",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7/",
            },
            {
               name: "FEDORA-2023-153404713b",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20240105-0004/",
            },
            {
               name: "FEDORA-2024-3bb23c77f3",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS/",
            },
            {
               name: "FEDORA-2023-55800423a8",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/",
            },
            {
               name: "FEDORA-2024-d946b9ad25",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/",
            },
            {
               name: "FEDORA-2024-71c2c6526c",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6/",
            },
            {
               name: "FEDORA-2024-39a8c72ea9",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/",
            },
            {
               url: "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002",
            },
            {
               name: "FEDORA-2024-ae653fb07b",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/",
            },
            {
               name: "FEDORA-2024-2705241461",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/",
            },
            {
               name: "FEDORA-2024-fb32950d11",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/",
            },
            {
               name: "FEDORA-2024-7b08207cdb",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/",
            },
            {
               name: "FEDORA-2024-06ebb70bdd",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/",
            },
            {
               name: "[debian-lts-announce] 20240125 [SECURITY] [DLA 3718-1] php-phpseclib security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html",
            },
            {
               name: "[debian-lts-announce] 20240125 [SECURITY] [DLA 3719-1] phpseclib security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html",
            },
            {
               name: "FEDORA-2024-a53b24023d",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/",
            },
            {
               name: "FEDORA-2024-3fd1bc9276",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/",
            },
            {
               url: "https://support.apple.com/kb/HT214084",
            },
            {
               name: "20240313 APPLE-SA-03-07-2024-2 macOS Sonoma 14.4",
               tags: [
                  "mailing-list",
               ],
               url: "http://seclists.org/fulldisclosure/2024/Mar/21",
            },
            {
               name: "[debian-lts-announce] 20240425 [SECURITY] [DLA 3794-1] putty security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html",
            },
            {
               name: "[oss-security] 20240417 Terrapin vulnerability in Jenkins CLI client",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2024/04/17/8",
            },
            {
               name: "[oss-security] 20240306 Multiple vulnerabilities in Jenkins plugins",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2024/03/06/3",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2023-48795",
      datePublished: "2023-12-18T00:00:00",
      dateReserved: "2023-11-20T00:00:00",
      dateUpdated: "2024-08-02T21:46:27.255Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-6918

Vulnerability from cvelistv5

Published

2023-12-18 23:27

Modified

2025-02-15 00:10

Severity ?

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2024:2504	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:3233	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2023-6918	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2254997	issue-tracking, x_refsource_REDHAT
	https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/
	https://www.libssh.org/security/advisories/CVE-2023-6918.txt

Impacted products

Vendor

Product

Version

▼

Red Hat

Red Hat Enterprise Linux 8

Unaffected: 0:0.9.6-14.el8   < *
    cpe:/a:redhat:enterprise_linux:8::appstream
    cpe:/o:redhat:enterprise_linux:8::baseos

Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:0.9.6-14.el8 < * cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:0.10.4-13.el9 < * cpe:/o:redhat:enterprise_linux:9::baseos cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:0.10.4-13.el9 < * cpe:/o:redhat:enterprise_linux:9::baseos cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2025-02-15T00:10:29.989Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2024:2504",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:2504",
               },
               {
                  name: "RHSA-2024:3233",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:3233",
               },
               {
                  tags: [
                     "vdb-entry",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2023-6918",
               },
               {
                  name: "RHBZ#2254997",
                  tags: [
                     "issue-tracking",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2254997",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.libssh.org/security/advisories/CVE-2023-6918.txt",
               },
               {
                  url: "https://security.netapp.com/advisory/ntap-20250214-0009/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:8::appstream",
                  "cpe:/o:redhat:enterprise_linux:8::baseos",
               ],
               defaultStatus: "affected",
               packageName: "libssh",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:0.9.6-14.el8",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:8::appstream",
                  "cpe:/o:redhat:enterprise_linux:8::baseos",
               ],
               defaultStatus: "affected",
               packageName: "libssh",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:0.9.6-14.el8",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9::baseos",
                  "cpe:/a:redhat:enterprise_linux:9::appstream",
               ],
               defaultStatus: "affected",
               packageName: "libssh",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:0.10.4-13.el9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9::baseos",
                  "cpe:/a:redhat:enterprise_linux:9::appstream",
               ],
               defaultStatus: "affected",
               packageName: "libssh",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:0.10.4-13.el9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:6",
               ],
               defaultStatus: "unknown",
               packageName: "libssh2",
               product: "Red Hat Enterprise Linux 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:7",
               ],
               defaultStatus: "unknown",
               packageName: "libssh",
               product: "Red Hat Enterprise Linux 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:7",
               ],
               defaultStatus: "unknown",
               packageName: "libssh2",
               product: "Red Hat Enterprise Linux 7",
               vendor: "Red Hat",
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Red Hat would like to thank Jack Weinstein (<mike.code.bb.h@gmail.com>) for reporting this issue.",
            },
         ],
         datePublic: "2023-12-18T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Low",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 3.7,
                  baseSeverity: "LOW",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-252",
                     description: "Unchecked Return Value",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-24T12:54:46.775Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2024:2504",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:2504",
            },
            {
               name: "RHSA-2024:3233",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:3233",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2023-6918",
            },
            {
               name: "RHBZ#2254997",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2254997",
            },
            {
               url: "https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/",
            },
            {
               url: "https://www.libssh.org/security/advisories/CVE-2023-6918.txt",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2023-12-18T00:00:00+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2023-12-18T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Libssh: missing checks for return values for digests",
         workarounds: [
            {
               lang: "en",
               value: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
            },
         ],
         x_redhatCweChain: "CWE-252: Unchecked Return Value",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2023-6918",
      datePublished: "2023-12-18T23:27:48.540Z",
      dateReserved: "2023-12-18T11:40:15.080Z",
      dateUpdated: "2025-02-15T00:10:29.989Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-1667

Vulnerability from cvelistv5

Published

2023-05-26 00:00

Modified

2024-08-02 05:57

Severity ?

Summary

A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.

References

▼	URL	Tags
	https://access.redhat.com/security/cve/CVE-2023-1667
	https://bugzilla.redhat.com/show_bug.cgi?id=2182199
	http://www.libssh.org/security/advisories/CVE-2023-1667.txt
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27PD44ALQTZXX7K6JAM3BXBUHYA6DFFN/	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2023/05/msg00029.html	mailing-list
	https://security.gentoo.org/glsa/202312-05	vendor-advisory

Impacted products

	Vendor	Product	Version
	n/a	libssh	Version: libssh-2

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T05:57:24.326Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2023-1667",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2182199",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.libssh.org/security/advisories/CVE-2023-1667.txt",
               },
               {
                  name: "FEDORA-2023-5fa5ca2043",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27PD44ALQTZXX7K6JAM3BXBUHYA6DFFN/",
               },
               {
                  name: "[debian-lts-announce] 20230529 [SECURITY] [DLA 3437-1] libssh security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2023/05/msg00029.html",
               },
               {
                  name: "GLSA-202312-05",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-05",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "libssh",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "libssh-2",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-476",
                     description: "CWE-476",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-12-22T10:06:17.929046",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://access.redhat.com/security/cve/CVE-2023-1667",
            },
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2182199",
            },
            {
               url: "http://www.libssh.org/security/advisories/CVE-2023-1667.txt",
            },
            {
               name: "FEDORA-2023-5fa5ca2043",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27PD44ALQTZXX7K6JAM3BXBUHYA6DFFN/",
            },
            {
               name: "[debian-lts-announce] 20230529 [SECURITY] [DLA 3437-1] libssh security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2023/05/msg00029.html",
            },
            {
               name: "GLSA-202312-05",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-05",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2023-1667",
      datePublished: "2023-05-26T00:00:00",
      dateReserved: "2023-03-27T00:00:00",
      dateUpdated: "2024-08-02T05:57:24.326Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-2283

Vulnerability from cvelistv5

Published

2023-05-26 00:00

Modified

2024-08-02 06:19

Severity ?

Summary

A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.

References

▼	URL	Tags
	https://access.redhat.com/security/cve/CVE-2023-2283
	https://www.libssh.org/security/advisories/CVE-2023-2283.txt
	https://bugzilla.redhat.com/show_bug.cgi?id=2189736
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27PD44ALQTZXX7K6JAM3BXBUHYA6DFFN/	vendor-advisory
	http://packetstormsecurity.com/files/172861/libssh-0.9.6-0.10.4-pki_verify_data_signature-Authorization-Bypass.html
	https://security.gentoo.org/glsa/202312-05	vendor-advisory
	https://security.netapp.com/advisory/ntap-20240201-0005/

Impacted products

	Vendor	Product	Version
	n/a	libssh	Version: libssh-2

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T06:19:14.319Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2023-2283",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.libssh.org/security/advisories/CVE-2023-2283.txt",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2189736",
               },
               {
                  name: "FEDORA-2023-5fa5ca2043",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27PD44ALQTZXX7K6JAM3BXBUHYA6DFFN/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/172861/libssh-0.9.6-0.10.4-pki_verify_data_signature-Authorization-Bypass.html",
               },
               {
                  name: "GLSA-202312-05",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-05",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20240201-0005/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "libssh",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "libssh-2",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-287",
                     description: "CWE-287",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-02-01T17:06:59.699395",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://access.redhat.com/security/cve/CVE-2023-2283",
            },
            {
               url: "https://www.libssh.org/security/advisories/CVE-2023-2283.txt",
            },
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2189736",
            },
            {
               name: "FEDORA-2023-5fa5ca2043",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27PD44ALQTZXX7K6JAM3BXBUHYA6DFFN/",
            },
            {
               url: "http://packetstormsecurity.com/files/172861/libssh-0.9.6-0.10.4-pki_verify_data_signature-Authorization-Bypass.html",
            },
            {
               name: "GLSA-202312-05",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-05",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20240201-0005/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2023-2283",
      datePublished: "2023-05-26T00:00:00",
      dateReserved: "2023-04-25T00:00:00",
      dateUpdated: "2024-08-02T06:19:14.319Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-1730

Vulnerability from cvelistv5

Published

2020-04-13 00:00

Modified

2024-08-04 06:46

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.

References

▼	URL	Tags
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLSWHBQ3EPKGTGLQNH554Z746BJ3C554/	vendor-advisory
	https://usn.ubuntu.com/4327-1/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2A7BIFKUYIYKTY7FX4BEWVC2OHS5DPOU/	vendor-advisory
	https://www.oracle.com/security-alerts/cpuoct2020.html
	https://www.libssh.org/security/advisories/CVE-2020-1730.txt
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1730
	https://security.netapp.com/advisory/ntap-20200424-0001/

Impacted products

	Vendor	Product	Version
	Red Hat	libssh	Version: libssh versions before 0.8.9 Version: libssh versions before 0.9.4

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T06:46:30.844Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "FEDORA-2020-5a77f0d68f",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLSWHBQ3EPKGTGLQNH554Z746BJ3C554/",
               },
               {
                  name: "USN-4327-1",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/4327-1/",
               },
               {
                  name: "FEDORA-2020-6cad41abb0",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2A7BIFKUYIYKTY7FX4BEWVC2OHS5DPOU/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.libssh.org/security/advisories/CVE-2020-1730.txt",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1730",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20200424-0001/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "libssh",
               vendor: "Red Hat",
               versions: [
                  {
                     status: "affected",
                     version: "libssh versions before 0.8.9",
                  },
                  {
                     status: "affected",
                     version: "libssh versions before 0.9.4",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-476",
                     description: "CWE-476",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-10-07T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "FEDORA-2020-5a77f0d68f",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLSWHBQ3EPKGTGLQNH554Z746BJ3C554/",
            },
            {
               name: "USN-4327-1",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://usn.ubuntu.com/4327-1/",
            },
            {
               name: "FEDORA-2020-6cad41abb0",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2A7BIFKUYIYKTY7FX4BEWVC2OHS5DPOU/",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
            },
            {
               url: "https://www.libssh.org/security/advisories/CVE-2020-1730.txt",
            },
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1730",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20200424-0001/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-1730",
      datePublished: "2020-04-13T00:00:00",
      dateReserved: "2019-11-27T00:00:00",
      dateUpdated: "2024-08-04T06:46:30.844Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_suse

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature