Alerts This Week
Warning Icon 1 1,394
Alerts This Week
Warning Icon 1 1,394

Fedora 42: libssh Critical Memory Leak & NULL Pointer Fix 2025-9826857157

fedora
Calendar Grey September 12, 2025
Dist Fedora Esm H88
An update for OpenSSL in CentOS 9 tackles significant vulnerabilities and enhances system reliability.
New upstream release fixing the following security weaknesses (CVE-2025-8114, CVE-2025-8277)

Summary

The ssh library was designed to be used by programmers needing a working SSH

implementation by the mean of a library. The complete control of the client is

made by the programmer. With libssh, you can remotely execute programs, transfer

files, use a secure and transparent tunnel for your remote programs. With its

Secure FTP implementation, you can play with remote files easily, without

third-party programs others than libcrypto (from openssl).

Update Information:

New upstream release fixing the following security weaknesses (CVE-2025-8114, CVE-2025-8277)

Topics%20covered

Topics Covered

security advisory fedora critical memory leak null pointer libssh

Change Log

* Tue Sep 9 2025 Jakub Jelen - 0.11.3-1 - New upstream release fixing the following security weaknesses: - CVE-2025-8114: Fix NULL pointer dereference after allocation failure - CVE-2025-8277: Fix memory leak of ephemeral key pair during repeated wrong KEX * Thu Jul 24 2025 Fedora Release Engineering - 0.11.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild

References


[ 1 ] Bug #2383237 - Private bug https://bugzilla.redhat.com/show_bug.cgi?id=2383237 [ 2 ] Bug #2394050 - CVE-2025-8277 libssh: Memory Exhaustion via Repeated Key Exchange in libssh [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2394050 [ 3 ] Bug #2394054 - CVE-2025-8114 libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2394054

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-9826857157' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: libssh
Product: Fedora 42
Version: 0.11.3
Release: 1.fc42
URL: http://www.libssh.org
Summary: A library implementing the SSH protocol

Topics%20covered

Topics Covered

security advisory fedora critical memory leak null pointer libssh

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here