Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 591
Alerts This Week
Warning Icon 1 591

Fedora 23: libssh2 Update Moderate: Diffie Hellman Risk

fedora
Calendar Grey February 26, 2016
Dist Fedora Esm H88
Fedora's libssh2 patch tackles a critical vulnerability in the Diffie-Hellman key exchange, substantially improving SSH security.
During the SSHv2 handshake when libssh2 is to get a suitable value for 'group order' in the Diffle Hellman negotiation, it would pass in number of bytes to a function that expected...

Summary

libssh2 is a library implementing the SSH2 protocol as defined by

Internet Drafts: SECSH-TRANS(22), SECSH-USERAUTH(25),

SECSH-CONNECTION(23), SECSH-ARCH(20), SECSH-FILEXFER(06)*,

SECSH-DHGEX(04), and SECSH-NUMBERS(10).

Update Information:

During the SSHv2 handshake when libssh2 is to get a suitable value for 'group order' in the Diffle Hellman negotiation, it would pass in number of bytes to a function that expected number of bits. This would result in the library generating numbers using only an 8th the number of random bits than what were intended: 128 or 256 bits instead of 1023 or 2047 Using such drastically reduced amount of random bits for Diffie Hellman weakened the handshake security significantly. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2016-0787 to this issue.

Topics%20covered

Topics Covered

security advisory moderate security issue Fedora SSH protocol libssh2 Diffie Hellman

Change Log

References


[ 1 ] Bug #1306021 - CVE-2016-0787 libssh2: bits/bytes confusion resulting in truncated Diffie-Hellman secret length https://bugzilla.redhat.com/show_bug.cgi?id=1306021

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update libssh2' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
important
Lowest
Low
Medium
High
Critical

Name: libssh2
Product: Fedora 23
Version: 1.6.0
Release: 4.fc23
URL: https://libssh2.org/
Summary: A library implementing the SSH2 protocol

Topics%20covered

Topics Covered

security advisory moderate security issue Fedora SSH protocol libssh2 Diffie Hellman

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.