Ubuntu 23.10: USN-6561-1 Critical: Libssh Prefix Truncation Attack

ubuntu

December 19, 2023

A security issue was fixed in libssh.

Summary

A security issue was fixed in libssh.

Software Description:

- libssh: A tiny C SSH library

Details:

Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH

protocol was vulnerable to a prefix truncation attack. If a remote attacker

was able to intercept SSH communications, extension negotiation messages

could be truncated, possibly leading to certain algorithms and features

being downgraded. This issue is known as the Terrapin attack. This update

adds protocol extensions to mitigate this issue.

Topics Covered

security advisory critical remote attack Ubuntu libssh prefix truncation

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
   libssh-4                        0.10.5-3ubuntu1.1

Ubuntu 23.04:
   libssh-4                        0.10.4-2ubuntu0.2

Ubuntu 22.04 LTS:
   libssh-4                        0.9.6-2ubuntu0.22.04.2

Ubuntu 20.04 LTS:
   libssh-4                        0.9.3-2ubuntu2.4

In general, a standard system update will make all the necessary changes.