The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4750 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include     redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH)     are installed using a special build of Red Hat Enterprise Linux with only the packages required to host     virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and     performing administrative tasks.

    Security Fix(es):

    * kernel: out-of-bounds write due to a heap buffer overflow in __hidinput_change_resolution_multipliers()     of hid-input.c (CVE-2021-0512)

    * Ansible: ansible-connection module discloses sensitive info in traceback error message (CVE-2021-3620)

    * kernel: Insufficient validation of user-supplied sizes for the MSG_CRYPTO message type (CVE-2021-43267)

    * libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL (CVE-2020-16135)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Red Hat Virtualization Host now includes packages from Red Hat Enterprise Linux 8.5. (BZ#1958101)

    * Red Hat Virtualization Host now includes packages from RHGS-3.5.z on RHEL-8 Batch #5. (BZ#1975175)

    * Red Hat Virtualization Host now includes the packages needed for using Managed Block Devices via     cinderlib. (BZ#1983021)

    * Red Hat Virtualization Host now includes openvswitch related packages from Fast Data Path 21.G release.
    (BZ#1998104)

    * Previously it was not possible to upgrade RHVH to version 4.4.8 when custom VDSM hooks were installed on     RHVH. This was caused by the VDSM hooks dependency on the concrete version of VDSM. The current release     allows users to maintain the VDSM dependency manually. In other words, if you want to upgrade from VDSM     X.Y.Z to version A.B.C, you must upgrade all VDSM hooks to the same A.B.C version. (BZ#2004469)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the libssh package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - libssh 0.9.4 has a NULL pointer dereference in     tftpserver.c if ssh_buffer_new returns     NULL.(CVE-2020-16135)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4387 advisory.

  - libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL (CVE-2020-16135)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4387 advisory.

    [0.9.4-3]
    - Fix CVE-2020-16135 NULL pointer dereference in sftpserver.c if       ssh_buffer_new returns NULL (#1862646)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
    (CVE-2020-16135)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the version of the libssh package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - libssh 0.9.4 has a NULL pointer dereference in     tftpserver.c if ssh_buffer_new returns     NULL.(CVE-2020-16135)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libssh package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - libssh 0.9.4 has a NULL pointer dereference in     tftpserver.c if ssh_buffer_new returns     NULL.(CVE-2020-16135)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has libssh packages installed that are affected by multiple vulnerabilities:

  - The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state     of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children     processes and allows local users to obtain sensitive information by leveraging a pid collision.
    (CVE-2014-0017)

  - A vulnerability was found in libssh's server-side state machine. A malicious client could create channels     without first performing authentication, resulting in unauthorized access. (CVE-2018-10933)

  - A flaw was found with the libssh API function ssh_scp_new(). A user able to connect to a server using SCP     could execute arbitrary command using a user-provided path, leading to a compromise of the remote target.
    (CVE-2019-14889)

  - A flaw was found in libssh. A NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
    (CVE-2020-16135)

  - A flaw was found in the way libssh handled AES-CTR (or DES ciphers if enabled) ciphers. The server or     client could crash when the connection hasn't been fully initialized and the system tries to cleanup the     ciphers when closing the connection. The biggest threat from this vulnerability is system availability.
    (CVE-2020-1730)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-2641:02 advisory.

    * libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL (CVE-2020-16135)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The code in src/sftpserver.c did not verify the validity of certain pointers and expected them to be valid. A NULL pointer dereference could have been occurred that typically causes a crash and thus a denial of service.

For Debian 9 stretch, this problem has been fixed in version 0.7.3-2+deb9u3.

We recommend that you upgrade your libssh packages.

For the detailed security status of libssh please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libssh

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4447-1 advisory.

    It was discovered that libssh incorrectly handled certain requests. An attacker could possibly use this     issue to cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0539-1 advisory.

    Update to version 0.9.8 (jsc#PED-7719):

    * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209)
    * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126)
    * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186)
    * Allow @ in usernames when parsing from URI composes

    Update to version 0.9.7

    * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm       guessing (bsc#1211188)
    * Fix CVE-2023-2283: a possible authorization bypass in       pki_verify_data_signature under low-memory conditions (bsc#1211190)
    * Fix several memory leaks in GSSAPI handling code

    Update to version 0.9.6 (bsc#1189608, CVE-2021-3634)

    * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6

    Update to version 0.9.5 (bsc#1174713, CVE-2020-16135):

    * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232)
    * Improve handling of library initialization (T222)
    * Fix parsing of subsecond times in SFTP (T219)
    * Make the documentation reproducible
    * Remove deprecated API usage in OpenSSL
    * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN
    * Define version in one place (T226)
    * Prevent invalid free when using different C runtimes than OpenSSL (T229)
    * Compatibility improvements to testsuite

    Update to version 0.9.4:

    * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/
    * Fix possible Denial of Service attack when using AES-CTR-ciphers       CVE-2020-1730 (bsc#1168699)

    Update to version 0.9.3:

    * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095)
    * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state
    * SSH-01-006 General: Various unchecked Null-derefs cause DOS
    * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys
    * SSH-01-010 SSH: Deprecated hash function in fingerprinting
    * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS
    * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access
    * SSH-01-001 State Machine: Initial machine states should be set explicitly
    * SSH-01-002 Kex: Differently bound macros used to iterate same array
    * SSH-01-005 Code-Quality: Integer sign confusion during assignments
    * SSH-01-008 SCP: Protocol Injection via unescaped File Names
    * SSH-01-009 SSH: Update documentation which RFCs are implemented
    * SSH-01-012 PKI: Information leak via uninitialized stack buffer

    Update to version 0.9.2:

    * Fixed libssh-config.cmake
    * Fixed issues with rsa algorithm negotiation (T191)
    * Fixed detection of OpenSSL ed25519 support (T197)

    Update to version 0.9.1:

    * Added support for Ed25519 via OpenSSL
    * Added support for X25519 via OpenSSL
    * Added support for localuser in Match keyword
    * Fixed Match keyword to be case sensitive
    * Fixed compilation with LibreSSL
    * Fixed error report of channel open (T75)
    * Fixed sftp documentation (T137)
    * Fixed known_hosts parsing (T156)
    * Fixed build issue with MinGW (T157)
    * Fixed build with gcc 9 (T164)
    * Fixed deprecation issues (T165)
    * Fixed known_hosts directory creation (T166)

    Update to verion 0.9.0:

    * Added support for AES-GCM
    * Added improved rekeying support
    * Added performance improvements
    * Disabled blowfish support by default
    * Fixed several ssh config parsing issues
    * Added support for DH Group Exchange KEX
    * Added support for Encrypt-then-MAC mode
    * Added support for parsing server side configuration file
    * Added support for ECDSA/Ed25519 certificates
    * Added FIPS 140-2 compatibility
    * Improved known_hosts parsing
    * Improved documentation
    * Improved OpenSSL API usage for KEX, DH, and signatures

    - Add libssh client and server config files

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
155654	RHEL 8 : Red Hat Virtualization Host security update [ovirt-4.4.9] 0-day (Important) (RHSA-2021:4750)	Nessus	Red Hat Local Security Checks	2021/11/20	2024/11/7	critical
145158	EulerOS 2.0 SP3 : libssh (EulerOS-SA-2021-1088)	Nessus	Huawei Local Security Checks	2021/1/20	2024/1/29	medium
155136	CentOS 8 : libssh (CESA-2021:4387)	Nessus	CentOS Local Security Checks	2021/11/11	2023/11/24	medium
155436	Oracle Linux 8 : libssh (ELSA-2021-4387)	Nessus	Oracle Linux Local Security Checks	2021/11/17	2024/11/2	medium
223397	Linux Distros Unpatched Vulnerability : CVE-2020-16135	Nessus	Misc.	2025/3/4	2026/7/27	medium
147106	EulerOS Virtualization for ARM 64 3.0.6.0 : libssh (EulerOS-SA-2021-1584)	Nessus	Huawei Local Security Checks	2021/3/4	2024/1/12	medium
147610	EulerOS Virtualization 2.9.1 : libssh (EulerOS-SA-2021-1608)	Nessus	Huawei Local Security Checks	2021/3/10	2024/1/10	medium
206832	NewStart CGSL MAIN 6.02 : libssh Multiple Vulnerabilities (NS-SA-2024-0052)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2026/2/24	critical
294073	MiracleLinux 8 : libssh-0.9.4-3.el8 (AXSA:2021-2641:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
139246	Debian DLA-2303-1 : libssh security update	Nessus	Debian Local Security Checks	2020/8/3	2024/2/27	medium
139367	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : libssh vulnerability (USN-4447-1)	Nessus	Ubuntu Local Security Checks	2020/8/6	2024/8/29	medium
190835	SUSE SLES12 Security Update : libssh (SUSE-SU-2024:0539-1)	Nessus	SuSE Local Security Checks	2024/2/21	2026/6/26	medium

检测

插件搜索

critical

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium