openSUSE Security Update: Security update for libssh2_org
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2020:2129-1
Rating:             moderate
References:         #1130103 #1178083 
Cross-References:   CVE-2019-17498 CVE-2019-3855 CVE-2019-3856
                    CVE-2019-3857 CVE-2019-3858 CVE-2019-3859
                    CVE-2019-3860 CVE-2019-3861 CVE-2019-3862
                    CVE-2019-3863
Affected Products:
                    openSUSE Leap 15.2
______________________________________________________________________________

   An update that fixes 10 vulnerabilities is now available.

Description:

   This update for libssh2_org fixes the following issues:

   - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and
     bugfixes:
       * adds ECDSA keys and host key support when using OpenSSL
       * adds ED25519 key and host key support when using OpenSSL 1.1.1
       * adds OpenSSH style key file reading
       * adds AES CTR mode support when using WinCNG
       * adds PEM passphrase protected file support for Libgcrypt and WinCNG
       * adds SHA256 hostkey fingerprint
       * adds libssh2_agent_get_identity_path() and
         libssh2_agent_set_identity_path()
       * adds explicit zeroing of sensitive data in memory
       * adds additional bounds checks to network buffer reads
       * adds the ability to use the server default permissions when creating
         sftp directories
       * adds support for building with OpenSSL no engine flag
       * adds support for building with LibreSSL
       * increased sftp packet size to 256k
       * fixed oversized packet handling in sftp
       * fixed building with OpenSSL 1.1
       * fixed a possible crash if sftp stat gets an unexpected response
       * fixed incorrect parsing of the KEX preference string value
       * fixed conditional RSA and AES-CTR support
       * fixed a small memory leak during the key exchange process
       * fixed a possible memory leak of the ssh banner string
       * fixed various small memory leaks in the backends
       * fixed possible out of bounds read when parsing public keys from the
         server
       * fixed possible out of bounds read when parsing invalid PEM files
       * no longer null terminates the scp remote exec command
       * now handle errors when diffie hellman key pair generation fails
       * improved building instructions
       * improved unit tests

   - Version update to 1.8.2: [bsc#1130103] Bug fixes:
       * Fixed the misapplied userauth patch that broke 1.8.1
       * moved the MAX size declarations from the public header This update
         was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.2:

      zypper in -t patch openSUSE-2020-2129=1



Package List:

   - openSUSE Leap 15.2 (i586 x86_64):

      libssh2-1-1.9.0-lp152.8.3.1
      libssh2-1-debuginfo-1.9.0-lp152.8.3.1
      libssh2-devel-1.9.0-lp152.8.3.1
      libssh2_org-debugsource-1.9.0-lp152.8.3.1

   - openSUSE Leap 15.2 (x86_64):

      libssh2-1-32bit-1.9.0-lp152.8.3.1
      libssh2-1-32bit-debuginfo-1.9.0-lp152.8.3.1


References:

   https://www.suse.com/security/cve/CVE-2019-17498.html
   https://www.suse.com/security/cve/CVE-2019-3855.html
   https://www.suse.com/security/cve/CVE-2019-3856.html
   https://www.suse.com/security/cve/CVE-2019-3857.html
   https://www.suse.com/security/cve/CVE-2019-3858.html
   https://www.suse.com/security/cve/CVE-2019-3859.html
   https://www.suse.com/security/cve/CVE-2019-3860.html
   https://www.suse.com/security/cve/CVE-2019-3861.html
   https://www.suse.com/security/cve/CVE-2019-3862.html
   https://www.suse.com/security/cve/CVE-2019-3863.html
   https://bugzilla.suse.com/1130103
   https://bugzilla.suse.com/1178083
_______________________________________________
openSUSE Security Announce mailing list -- [email protected]
To unsubscribe, email [email protected]
List Netiquette: https://en.opensuse.org/openSUSE:Mailing_list_netiquette
List Archives: https://lists.opensuse.org/archives/list/[email protected]