USN-6138-1: libssh vulnerabilities

Releases

• Ubuntu 23.04
• Ubuntu 22.10
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• libssh - A tiny C SSH library

Details

Philip Turnbull discovered that libssh incorrectly handled rekeying with
algorithm guessing. A remote attacker could use this issue to cause libssh
to crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2023-1667)

Kevin Backhouse discovered that libssh incorrectly handled verifying data
signatures. A remote attacker could possibly use this issue to bypass
authorization. (CVE-2023-2283)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.04

• libssh-4 - 0.10.4-2ubuntu0.1

Ubuntu 22.10

• libssh-4 - 0.9.6-2ubuntu0.22.10.1

Ubuntu 22.04

• libssh-4 - 0.9.6-2ubuntu0.22.04.1

Ubuntu 20.04

• libssh-4 - 0.9.3-2ubuntu2.3

In general, a standard system update will make all the necessary changes.

References

• CVE-2023-1667
• CVE-2023-2283