Stay Secure with the Latest Linux Advisories

security advisorysecurity issueRed Hat Enterprise Linux

Red Hat Enterprise Linux 8: RHSA-2021-4387 Low: libssh NULL Pointer Issue

An update for libssh is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Low: libssh security update Advisory ID: RHSA-2021:4387-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:4387 Issue date: 2021-11-09 CVE Names: CVE-2020-16135 ==================================================================== 1. Summary: An update for libssh is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL (CVE-2020-16135) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory,refer to: https://access.redhat.com/articles/11258 After installing these updated packages, all running applications using libssh must be restarted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1862456 - CVE-2020-16135 libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): aarch64: libssh-debuginfo-0.9.4-3.el8.aarch64.rpm libssh-debugsource-0.9.4-3.el8.aarch64.rpm libssh-devel-0.9.4-3.el8.aarch64.rpm ppc64le: libssh-debuginfo-0.9.4-3.el8.ppc64le.rpm libssh-debugsource-0.9.4-3.el8.ppc64le.rpm libssh-devel-0.9.4-3.el8.ppc64le.rpm s390x: libssh-debuginfo-0.9.4-3.el8.s390x.rpm libssh-debugsource-0.9.4-3.el8.s390x.rpm libssh-devel-0.9.4-3.el8.s390x.rpm x86_64: libssh-debuginfo-0.9.4-3.el8.i686.rpm libssh-debuginfo-0.9.4-3.el8.x86_64.rpm libssh-debugsource-0.9.4-3.el8.i686.rpm libssh-debugsource-0.9.4-3.el8.x86_64.rpm libssh-devel-0.9.4-3.el8.i686.rpm libssh-devel-0.9.4-3.el8.x86_64.rpm Red Hat Enterprise Linux BaseOS (v. 8): Source: libssh-0.9.4-3.el8.src.rpm aarch64: libssh-0.9.4-3.el8.aarch64.rpm libssh-debuginfo-0.9.4-3.el8.aarch64.rpm libssh-debugsource-0.9.4-3.el8.aarch64.rpm noarch: libssh-config-0.9.4-3.el8.noarch.rpm ppc64le: libssh-0.9.4-3.el8.ppc64le.rpm libssh-debuginfo-0.9.4-3.el8.ppc64le.rpm libssh-debugsource-0.9.4-3.el8.ppc64le.rpm s390x: libssh-0.9.4-3.el8.s390x.rpm libssh-debuginfo-0.9.4-3.el8.s390x.rpm libssh-debugsource-0.9.4-3.el8.s390x.rpm x86_64: libssh-0.9.4-3.el8.i686.rpm libssh-0.9.4-3.el8.x86_64.rpm libssh-debuginfo-0.9.4-3.el8.i686.rpm libssh-debuginfo-0.9.4-3.el8.x86_64.rpm libssh-debugsource-0.9.4-3.el8.i686.rpm libssh-debugsource-0.9.4-3.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7.References: https://access.redhat.com/security/cve/CVE-2020-16135 https://access.redhat.com/security/updates/classification#low https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/8.5_release_notes/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYYrdodzjgjWX9erEAQiqwg/7BYb207D8i9w/qntsnhHOFR4gtRGuVhsJ 6U2eVdsrxdP7TfIViRXr6CJLMK2Xqv793eXvb1Nlx1Yp/R8UpSpsKyBY3r2Sdbkt lDmVtEvgVoXW5LHfgRCkk0+/tHNz8YOzyiVhvlIb04vfHxwTge3s62UUylvnEu00 ss8farUPMhVK+ohPQDXYe7XaA31KqeFr0wz3wEXh5oHoX2Hor3AzK4fFM+id9xL8 ALOTm2Rp/Z7w050mc4HnM7883x1if2tYayQc7ZbXSJ96thEfv/5z9UIF0Gh5lTxU X/bVIUP2wUVpuLXZYPVN/aUNlemGNjWWVBMGqsRv0bTLjzT528NuEDJba73yJ7MM TMlw8+tIlu27FJv7LgK8pVTiJa981JhokTXYe5/h7bOpUoKxAWYW1ViK3mRO1iUh tTdRiJtuBJdVPMgtVn/WXpYYol4GQAb7EO4L1eD1CoRTUBfTt4/VarFF7c2QyWAi uCGjf8gSh8qR3YC6KQ5bMp69zQIYfTtStvlVKHjSGVX45x7QwUU3n7YOcAJgRoXW SLD2ZNIy3ai1WkyNFMKOrxYHmvhwy0NbtqY+EupqpurWFLgVUxFprxn5MfDwYM4W qJQxXHPXRMg8nzLmV6cGFs1nYwQxIXW+jDheQmdp2828KAFURDCxD06hNHIkXv68 3FtGTddeHIw=7sSo -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Keep abreast of the new security patch for Red Hat's libssh, rated as minimal threat, and understand its potential effects.. libssh Update, Red Hat Advisory, Low Severity Security Update. . Severity: Low. LinuxSecurity.com Team

Nov 09, 2021 •Low Red Hat