SUSE Security Update: Security update for libssh2_org
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:3551-1
Rating:             moderate
References:         #1130103 #1178083 SLE-16922 
Cross-References:   CVE-2019-17498 CVE-2019-3855 CVE-2019-3856
                    CVE-2019-3857 CVE-2019-3858 CVE-2019-3859
                    CVE-2019-3860 CVE-2019-3861 CVE-2019-3862
                    CVE-2019-3863
Affected Products:
                    SUSE Linux Enterprise Server for SAP 15
                    SUSE Linux Enterprise Server 15-LTSS
                    SUSE Linux Enterprise Module for Basesystem 15-SP2
                    SUSE Linux Enterprise Module for Basesystem 15-SP1
                    SUSE Linux Enterprise High Performance Computing 15-LTSS
                    SUSE Linux Enterprise High Performance Computing 15-ESPOS
______________________________________________________________________________

   An update that fixes 10 vulnerabilities, contains one
   feature is now available.

Description:

   This update for libssh2_org fixes the following issues:

   - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and
     bugfixes:
       * adds ECDSA keys and host key support when using OpenSSL
       * adds ED25519 key and host key support when using OpenSSL 1.1.1
       * adds OpenSSH style key file reading
       * adds AES CTR mode support when using WinCNG
       * adds PEM passphrase protected file support for Libgcrypt and WinCNG
       * adds SHA256 hostkey fingerprint
       * adds libssh2_agent_get_identity_path() and
         libssh2_agent_set_identity_path()
       * adds explicit zeroing of sensitive data in memory
       * adds additional bounds checks to network buffer reads
       * adds the ability to use the server default permissions when creating
         sftp directories
       * adds support for building with OpenSSL no engine flag
       * adds support for building with LibreSSL
       * increased sftp packet size to 256k
       * fixed oversized packet handling in sftp
       * fixed building with OpenSSL 1.1
       * fixed a possible crash if sftp stat gets an unexpected response
       * fixed incorrect parsing of the KEX preference string value
       * fixed conditional RSA and AES-CTR support
       * fixed a small memory leak during the key exchange process
       * fixed a possible memory leak of the ssh banner string
       * fixed various small memory leaks in the backends
       * fixed possible out of bounds read when parsing public keys from the
         server
       * fixed possible out of bounds read when parsing invalid PEM files
       * no longer null terminates the scp remote exec command
       * now handle errors when diffie hellman key pair generation fails
       * improved building instructions
       * improved unit tests

   - Version update to 1.8.2: [bsc#1130103] Bug fixes:
       * Fixed the misapplied userauth patch that broke 1.8.1
       * moved the MAX size declarations from the public header


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server for SAP 15:

      zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2020-3551=1

   - SUSE Linux Enterprise Server 15-LTSS:

      zypper in -t patch SUSE-SLE-Product-SLES-15-2020-3551=1

   - SUSE Linux Enterprise Module for Basesystem 15-SP2:

      zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP2-2020-3551=1

   - SUSE Linux Enterprise Module for Basesystem 15-SP1:

      zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2020-3551=1

   - SUSE Linux Enterprise High Performance Computing 15-LTSS:

      zypper in -t patch SUSE-SLE-Product-HPC-15-2020-3551=1

   - SUSE Linux Enterprise High Performance Computing 15-ESPOS:

      zypper in -t patch SUSE-SLE-Product-HPC-15-2020-3551=1



Package List:

   - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64):

      libssh2-1-1.9.0-4.13.1
      libssh2-1-debuginfo-1.9.0-4.13.1
      libssh2-devel-1.9.0-4.13.1
      libssh2_org-debugsource-1.9.0-4.13.1

   - SUSE Linux Enterprise Server for SAP 15 (x86_64):

      libssh2-1-32bit-1.9.0-4.13.1
      libssh2-1-32bit-debuginfo-1.9.0-4.13.1

   - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x):

      libssh2-1-1.9.0-4.13.1
      libssh2-1-debuginfo-1.9.0-4.13.1
      libssh2-devel-1.9.0-4.13.1
      libssh2_org-debugsource-1.9.0-4.13.1

   - SUSE Linux Enterprise Module for Basesystem 15-SP2 (aarch64 ppc64le s390x x86_64):

      libssh2-1-1.9.0-4.13.1
      libssh2-1-debuginfo-1.9.0-4.13.1
      libssh2-devel-1.9.0-4.13.1
      libssh2_org-debugsource-1.9.0-4.13.1

   - SUSE Linux Enterprise Module for Basesystem 15-SP2 (x86_64):

      libssh2-1-32bit-1.9.0-4.13.1
      libssh2-1-32bit-debuginfo-1.9.0-4.13.1

   - SUSE Linux Enterprise Module for Basesystem 15-SP1 (aarch64 ppc64le s390x x86_64):

      libssh2-1-1.9.0-4.13.1
      libssh2-1-debuginfo-1.9.0-4.13.1
      libssh2-devel-1.9.0-4.13.1
      libssh2_org-debugsource-1.9.0-4.13.1

   - SUSE Linux Enterprise Module for Basesystem 15-SP1 (x86_64):

      libssh2-1-32bit-1.9.0-4.13.1
      libssh2-1-32bit-debuginfo-1.9.0-4.13.1

   - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64):

      libssh2-1-1.9.0-4.13.1
      libssh2-1-debuginfo-1.9.0-4.13.1
      libssh2-devel-1.9.0-4.13.1
      libssh2_org-debugsource-1.9.0-4.13.1

   - SUSE Linux Enterprise High Performance Computing 15-LTSS (x86_64):

      libssh2-1-32bit-1.9.0-4.13.1
      libssh2-1-32bit-debuginfo-1.9.0-4.13.1

   - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64):

      libssh2-1-1.9.0-4.13.1
      libssh2-1-debuginfo-1.9.0-4.13.1
      libssh2-devel-1.9.0-4.13.1
      libssh2_org-debugsource-1.9.0-4.13.1

   - SUSE Linux Enterprise High Performance Computing 15-ESPOS (x86_64):

      libssh2-1-32bit-1.9.0-4.13.1
      libssh2-1-32bit-debuginfo-1.9.0-4.13.1


References:

   https://www.suse.com/security/cve/CVE-2019-17498.html
   https://www.suse.com/security/cve/CVE-2019-3855.html
   https://www.suse.com/security/cve/CVE-2019-3856.html
   https://www.suse.com/security/cve/CVE-2019-3857.html
   https://www.suse.com/security/cve/CVE-2019-3858.html
   https://www.suse.com/security/cve/CVE-2019-3859.html
   https://www.suse.com/security/cve/CVE-2019-3860.html
   https://www.suse.com/security/cve/CVE-2019-3861.html
   https://www.suse.com/security/cve/CVE-2019-3862.html
   https://www.suse.com/security/cve/CVE-2019-3863.html
   https://bugzilla.suse.com/1130103
   https://bugzilla.suse.com/1178083

SUSE: 2020:3551-1 moderate: libssh2_org

November 27, 2020
An update that fixes 10 vulnerabilities, contains one feature is now available

Summary

This update for libssh2_org fixes the following issues: - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2020-3551=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2020-3551=1 - SUSE Linux Enterprise Module for Basesystem 15-SP2: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP2-2020-3551=1 - SUSE Linux Enterprise Module for Basesystem 15-SP1: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2020-3551=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2020-3551=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2020-3551=1 Package List: - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64): libssh2-1-1.9.0-4.13.1 libssh2-1-debuginfo-1.9.0-4.13.1 libssh2-devel-1.9.0-4.13.1 libssh2_org-debugsource-1.9.0-4.13.1 - SUSE Linux Enterprise Server for SAP 15 (x86_64): libssh2-1-32bit-1.9.0-4.13.1 libssh2-1-32bit-debuginfo-1.9.0-4.13.1 - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x): libssh2-1-1.9.0-4.13.1 libssh2-1-debuginfo-1.9.0-4.13.1 libssh2-devel-1.9.0-4.13.1 libssh2_org-debugsource-1.9.0-4.13.1 - SUSE Linux Enterprise Module for Basesystem 15-SP2 (aarch64 ppc64le s390x x86_64): libssh2-1-1.9.0-4.13.1 libssh2-1-debuginfo-1.9.0-4.13.1 libssh2-devel-1.9.0-4.13.1 libssh2_org-debugsource-1.9.0-4.13.1 - SUSE Linux Enterprise Module for Basesystem 15-SP2 (x86_64): libssh2-1-32bit-1.9.0-4.13.1 libssh2-1-32bit-debuginfo-1.9.0-4.13.1 - SUSE Linux Enterprise Module for Basesystem 15-SP1 (aarch64 ppc64le s390x x86_64): libssh2-1-1.9.0-4.13.1 libssh2-1-debuginfo-1.9.0-4.13.1 libssh2-devel-1.9.0-4.13.1 libssh2_org-debugsource-1.9.0-4.13.1 - SUSE Linux Enterprise Module for Basesystem 15-SP1 (x86_64): libssh2-1-32bit-1.9.0-4.13.1 libssh2-1-32bit-debuginfo-1.9.0-4.13.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): libssh2-1-1.9.0-4.13.1 libssh2-1-debuginfo-1.9.0-4.13.1 libssh2-devel-1.9.0-4.13.1 libssh2_org-debugsource-1.9.0-4.13.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (x86_64): libssh2-1-32bit-1.9.0-4.13.1 libssh2-1-32bit-debuginfo-1.9.0-4.13.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): libssh2-1-1.9.0-4.13.1 libssh2-1-debuginfo-1.9.0-4.13.1 libssh2-devel-1.9.0-4.13.1 libssh2_org-debugsource-1.9.0-4.13.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (x86_64): libssh2-1-32bit-1.9.0-4.13.1 libssh2-1-32bit-debuginfo-1.9.0-4.13.1

References

#1130103 #1178083 SLE-16922

Cross- CVE-2019-17498 CVE-2019-3855 CVE-2019-3856

CVE-2019-3857 CVE-2019-3858 CVE-2019-3859

CVE-2019-3860 CVE-2019-3861 CVE-2019-3862

CVE-2019-3863

Affected Products:

SUSE Linux Enterprise Server for SAP 15

SUSE Linux Enterprise Server 15-LTSS

SUSE Linux Enterprise Module for Basesystem 15-SP2

SUSE Linux Enterprise Module for Basesystem 15-SP1

SUSE Linux Enterprise High Performance Computing 15-LTSS

SUSE Linux Enterprise High Performance Computing 15-ESPOS

https://www.suse.com/security/cve/CVE-2019-17498.html

https://www.suse.com/security/cve/CVE-2019-3855.html

https://www.suse.com/security/cve/CVE-2019-3856.html

https://www.suse.com/security/cve/CVE-2019-3857.html

https://www.suse.com/security/cve/CVE-2019-3858.html

https://www.suse.com/security/cve/CVE-2019-3859.html

https://www.suse.com/security/cve/CVE-2019-3860.html

https://www.suse.com/security/cve/CVE-2019-3861.html

https://www.suse.com/security/cve/CVE-2019-3862.html

https://www.suse.com/security/cve/CVE-2019-3863.html

https://bugzilla.suse.com/1130103

https://bugzilla.suse.com/1178083

Severity
Announcement ID: SUSE-SU-2020:3551-1
Rating: moderate

Related News

19.Laptop Bed Esm H320
2 - 3 min read
AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a
32.Lock Code Circular Esm H320
2 - 3 min read
Linux admins and security practitioners face significant challenges in keeping their Linux systems secure amidst the constant threat of kernel bugs.
1.Penguin Landscape Esm H320
2 - 3 min read
A significant security threat, known as the Spectre v2 exploit, has been observed targeting Linux systems running on modern Intel processors. Let's
10.FingerPrint Locks Esm H320
2 - 3 min read
The recent release of I2P 2.5.0 , an anonymous P2P network that protects against online censorship, surveillance, and monitoring, has brought a slew
24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
30.Lock Globe Motherboard Esm H320
1 - 2 min read
The SPDX 3.0 release marks a significant milestone in software management, particularly for Linux admins, infosec professionals, internet security
11.Locks IsometricPattern Esm H320
2 - 3 min read
Open Source maintainers and developers have been warned about the continued wave of attacks aimed at project maintainers similar to those recently
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved