Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 730
Alerts This Week
Warning Icon 1 730

Ubuntu 18.04 & 16.04 USN-6592-2 Critical Libssh Code Injection

ubuntu
Calendar Grey February 5, 2024
Dist Ubuntu Esm H88
Libssh security flaws resolved in Ubuntu Security Announcement USN-6593-3 impacting various LTS versions.
Several security issues were fixed in libssh.

Summary

Several security issues were fixed in libssh.

Software Description:

- libssh: A tiny C SSH library

Details:

USN-6592-1 fixed vulnerabilities in libssh. This update provides the

corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

It was discovered that libssh incorrectly handled the ProxyCommand and the

ProxyJump features. A remote attacker could possibly use this issue to

inject malicious code into the command of the features mentioned through

the hostname parameter. (CVE-2023-6004)

It was discovered that libssh incorrectly handled return codes when

performing message digest operations. A remote attacker could possibly use

this issue to cause libssh to crash, obtain sensitive information, or

execute arbitrary code. (CVE-2023-6918)

Topics%20covered

Topics Covered

security advisory remote code execution vulnerability ubuntu code injection libssh

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libssh-4 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm3
libssh-gcrypt-4 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm3

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libssh-4 0.6.3-4.3ubuntu0.6+esm1
libssh-gcrypt-4 0.6.3-4.3ubuntu0.6+esm1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6592-2

https://ubuntu.com/security/notices/USN-6592-1

CVE-2023-6004, CVE-2023-6918

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-6592-2

Topics%20covered

Topics Covered

security advisory remote code execution vulnerability ubuntu code injection libssh

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.