Ubuntu 23.04 LTS USN-6140-2 Serious Libcurl Vulnerability Mitigation Steps

ubuntu

June 5, 2023

Several security issues were fixed in libssh.

Summary

Several security issues were fixed in libssh.

Software Description:

- libssh: A tiny C SSH library

Details:

Philip Turnbull discovered that libssh incorrectly handled rekeying with

algorithm guessing. A remote attacker could use this issue to cause libssh

to crash, resulting in a denial of service, or possibly execute arbitrary

code. (CVE-2023-1667)

Kevin Backhouse discovered that libssh incorrectly handled verifying data

signatures. A remote attacker could possibly use this issue to bypass

authorization. (CVE-2023-2283)

Topics Covered

security advisory denial of service critical remote code execution Ubuntu libssh

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
   libssh-4                        0.10.4-2ubuntu0.1

Ubuntu 22.10:
   libssh-4                        0.9.6-2ubuntu0.22.10.1

Ubuntu 22.04 LTS:
   libssh-4                        0.9.6-2ubuntu0.22.04.1

Ubuntu 20.04 LTS:
   libssh-4                        0.9.3-2ubuntu2.3

In general, a standard system update will make all the necessary changes.