Headline
Ubuntu Security Notice USN-6592-1
Ubuntu Security Notice 6592-1 - It was discovered that libssh incorrectly handled the ProxyCommand and the ProxyJump features. A remote attacker could possibly use this issue to inject malicious code into the command of the features mentioned through the hostname parameter. It was discovered that libssh incorrectly handled return codes when performing message digest operations. A remote attacker could possibly use this issue to cause libssh to crash, obtain sensitive information, or execute arbitrary code.
==========================================================================
Ubuntu Security Notice USN-6592-1
January 22, 2024
libssh vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in libssh.
Software Description:
- libssh: A tiny C SSH library
Details:
It was discovered that libssh incorrectly handled the ProxyCommand and the
ProxyJump features. A remote attacker could possibly use this issue to
inject malicious code into the command of the features mentioned through
the hostname parameter. (CVE-2023-6004)
It was discovered that libssh incorrectly handled return codes when
performing message digest operations. A remote attacker could possibly use
this issue to cause libssh to crash, obtain sensitive information, or
execute arbitrary code. (CVE-2023-6918)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
libssh-4 0.10.5-3ubuntu1.2
Ubuntu 23.04:
libssh-4 0.10.4-2ubuntu0.3
Ubuntu 22.04 LTS:
libssh-4 0.9.6-2ubuntu0.22.04.3
Ubuntu 20.04 LTS:
libssh-4 0.9.3-2ubuntu2.5
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6592-1
CVE-2023-6004, CVE-2023-6918
Package Information:
https://launchpad.net/ubuntu/+source/libssh/0.10.5-3ubuntu1.2
https://launchpad.net/ubuntu/+source/libssh/0.10.4-2ubuntu0.3
https://launchpad.net/ubuntu/+source/libssh/0.9.6-2ubuntu0.22.04.3
https://launchpad.net/ubuntu/+source/libssh/0.9.3-2ubuntu2.5
Related news
Red Hat Security Advisory 2024-2504-03 - An update for libssh is now available for Red Hat Enterprise Linux 9.
Ubuntu Security Notice 6592-2 - USN-6592-1 fixed vulnerabilities in libssh. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. It was discovered that libssh incorrectly handled the ProxyCommand and the ProxyJump features. A remote attacker could possibly use this issue to inject malicious code into the command of the features mentioned through the hostname parameter.
Debian Linux Security Advisory 5591-1 - Several vulnerabilities were discovered in libssh, a tiny C SSH library.
Debian Linux Security Advisory 5591-1 - Several vulnerabilities were discovered in libssh, a tiny C SSH library.
Gentoo Linux Security Advisory 202312-16 - Multiple vulnerabilities have been discovered in libssh, the worst of which could lead to code execution. Versions greater than or equal to 0.10.6 are affected.