This update for libssh fixes the following issues :

  - CVE-2020-1730: Fixed a possible denial of service when     using AES-CTR (bsc#1168699).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4327-1 advisory.

    Yasheng Yang discovered that libssh incorrectly handled AES-CTR ciphers. A remote attacker could possibly     use this issue to cause libssh to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libssh fixes the following issues :

CVE-2020-1730: Fixed a possible denial of service when using AES-CTR (bsc#1168699).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4545 advisory.

  - A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8.
    When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is     executed on the server-side. In case the library is used in a way where users can influence the third     parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading     to a compromise of the remote target. (CVE-2019-14889)

  - A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES     ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully     initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat     from this vulnerability is system availability. (CVE-2020-1730)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0067 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-14889:
    A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8.
    When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is     executed on the server-side. In case the library is used in a way where users can influence the third     parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading     to a compromise of the remote target.

    CVE-2020-1730:
    A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES     ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully     initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat     from this vulnerability is system availability.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has libssh packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES     ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully     initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat     from this vulnerability is system availability. (CVE-2020-1730)

  - A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8.
    When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is     executed on the server-side. In case the library is used in a way where users can influence the third     parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading     to a compromise of the remote target. (CVE-2019-14889)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0525-1 advisory.

    Update to version 0.9.8 (jsc#PED-7719):

    * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209)
    * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126)
    * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186)
    * Allow @ in usernames when parsing from URI composes

    Update to version 0.9.7:

    * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm       guessing (bsc#1211188)
    * Fix CVE-2023-2283: a possible authorization bypass in       pki_verify_data_signature under low-memory conditions (bsc#1211190)
    * Fix several memory leaks in GSSAPI handling code

    Update to version 0.9.6 (bsc#1189608, CVE-2021-3634):

    * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6


    Update to 0.9.5 (bsc#1174713, CVE-2020-16135):

    * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232)
    * Improve handling of library initialization (T222)
    * Fix parsing of subsecond times in SFTP (T219)
    * Make the documentation reproducible
    * Remove deprecated API usage in OpenSSL
    * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN
    * Define version in one place (T226)
    * Prevent invalid free when using different C runtimes than OpenSSL (T229)
    * Compatibility improvements to testsuite

    Update to version 0.9.4

    * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/
    * Fix possible Denial of Service attack when using AES-CTR-ciphers       CVE-2020-1730 (bsc#1168699)

    Update to version 0.9.3

    * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095)
    * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state
    * SSH-01-006 General: Various unchecked Null-derefs cause DOS
    * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys
    * SSH-01-010 SSH: Deprecated hash function in fingerprinting
    * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS
    * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access
    * SSH-01-001 State Machine: Initial machine states should be set explicitly
    * SSH-01-002 Kex: Differently bound macros used to iterate same array
    * SSH-01-005 Code-Quality: Integer sign confusion during assignments
    * SSH-01-008 SCP: Protocol Injection via unescaped File Names
    * SSH-01-009 SSH: Update documentation which RFCs are implemented
    * SSH-01-012 PKI: Information leak via uninitialized stack buffer

    Update to version 0.9.2

    * Fixed libssh-config.cmake
    * Fixed issues with rsa algorithm negotiation (T191)
    * Fixed detection of OpenSSL ed25519 support (T197)

    Update to version 0.9.1

    * Added support for Ed25519 via OpenSSL
    * Added support for X25519 via OpenSSL
    * Added support for localuser in Match keyword
    * Fixed Match keyword to be case sensitive
    * Fixed compilation with LibreSSL
    * Fixed error report of channel open (T75)
    * Fixed sftp documentation (T137)
    * Fixed known_hosts parsing (T156)
    * Fixed build issue with MinGW (T157)
    * Fixed build with gcc 9 (T164)
    * Fixed deprecation issues (T165)
    * Fixed known_hosts directory creation (T166)

    - Split out configuration to separate package to not mess up the       library packaging and coinstallation

    Update to verion 0.9.0

    * Added support for AES-GCM
    * Added improved rekeying support
    * Added performance improvements
    * Disabled blowfish support by default
    * Fixed several ssh config parsing issues
    * Added support for DH Group Exchange KEX
    * Added support for Encrypt-then-MAC mode
    * Added support for parsing server side configuration file
    * Added support for ECDSA/Ed25519 certificates
    * Added FIPS 140-2 compatibility
    * Improved known_hosts parsing
    * Improved documentation
    * Improved OpenSSL API usage for KEX, DH, and signatures

    - Add libssh client and server config files

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the libssh package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in libssh versions before 0.8.9 and     before 0.9.4 in the way it handled AES-CTR (or DES     ciphers if enabled) ciphers. The server or client could     crash when the connection hasn't been fully initialized     and the system tries to cleanup the ciphers when     closing the connection. The biggest threat from this     vulnerability is system availability.(CVE-2020-1730)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4545 advisory.

    - Add a test for CVE-2019-14889
    - Fixed CVE-2019-14889 (#1781782)
    - Fixed CVE-2020-1730 (#1802422)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202004-08 (libssh: Denial of service)

    It was discovered that libssh could crash when AES-CTR ciphers are used.
  Impact :

    A remote attacker running a malicious client or server could possibly       crash the counterpart implemented with libssh and cause a Denial of       Service condition.
  Workaround :

    Disable AES-CTR ciphers. If you implement a server using libssh it is       recommended to use a prefork model so each session runs in an own       process.

According to the version of the libssh package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A flaw was found in libssh versions before 0.8.9 and     before 0.9.4 in the way it handled AES-CTR (or DES     ciphers if enabled) ciphers. The server or client could     crash when the connection hasn't been fully initialized     and the system tries to cleanup the ciphers when     closing the connection. The biggest threat from this     vulnerability is system availability.(CVE-2020-1730)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K05295501 advisory.

  - A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES     ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully     initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat     from this vulnerability is system availability. (CVE-2020-1730)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:5218 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include     redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH)     are installed using a special build of Red Hat Enterprise Linux with only the packages required to host     virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and     performing administrative tasks.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include     redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH)     are installed using a special build of Red Hat Enterprise Linux with only the packages required to host     virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and     performing administrative tasks.

    The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-     virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed     using a special build of Red Hat Enterprise Linux with only the packages required to host virtual     machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing     administrative tasks.

    The following packages have been upgraded to a later upstream version: imgbased (1.2.13), redhat-release-     virtualization-host (4.4.3), redhat-virtualization-host (4.4.3). (BZ#1814517, BZ#1868293, BZ#1886484)

    Security Fix(es):

    * libssh: denial of service when handling AES-CTR (or DES) ciphers (CVE-2020-1730)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [security] gnutls_set_default_priority() (and thus Cockpit logins) fails when selecting VPP profile     during RHVH installation (BZ#1835661)

    * Unable to upgrade from rhvh 4.4.1 to 4.4.2 as block storage domains are detected as local storage     domains. (BZ#1886647)

    * Failed to install RHVH 4.4.3 due to missing Lvm ThinPool (BZ#1886695)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has libssh packages installed that are affected by multiple vulnerabilities:

  - The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state     of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children     processes and allows local users to obtain sensitive information by leveraging a pid collision.
    (CVE-2014-0017)

  - A vulnerability was found in libssh's server-side state machine. A malicious client could create channels     without first performing authentication, resulting in unauthorized access. (CVE-2018-10933)

  - A flaw was found with the libssh API function ssh_scp_new(). A user able to connect to a server using SCP     could execute arbitrary command using a user-provided path, leading to a compromise of the remote target.
    (CVE-2019-14889)

  - A flaw was found in libssh. A NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
    (CVE-2020-16135)

  - A flaw was found in the way libssh handled AES-CTR (or DES ciphers if enabled) ciphers. The server or     client could crash when the connection hasn't been fully initialized and the system tries to cleanup the     ciphers when closing the connection. The biggest threat from this vulnerability is system availability.
    (CVE-2020-1730)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4545 advisory.

    libssh is a library which implements the SSH protocol. It can be used to implement client and server     applications.

    The following packages have been upgraded to a later upstream version: libssh (0.9.4). (BZ#1804797)

    Security Fix(es):

    * libssh: denial of service when handling AES-CTR (or DES) ciphers (CVE-2020-1730)

    * libssh: unsanitized location in scp could lead to unwanted command execution (CVE-2019-14889)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0539-1 advisory.

    Update to version 0.9.8 (jsc#PED-7719):

    * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209)
    * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126)
    * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186)
    * Allow @ in usernames when parsing from URI composes

    Update to version 0.9.7

    * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm       guessing (bsc#1211188)
    * Fix CVE-2023-2283: a possible authorization bypass in       pki_verify_data_signature under low-memory conditions (bsc#1211190)
    * Fix several memory leaks in GSSAPI handling code

    Update to version 0.9.6 (bsc#1189608, CVE-2021-3634)

    * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6

    Update to version 0.9.5 (bsc#1174713, CVE-2020-16135):

    * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232)
    * Improve handling of library initialization (T222)
    * Fix parsing of subsecond times in SFTP (T219)
    * Make the documentation reproducible
    * Remove deprecated API usage in OpenSSL
    * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN
    * Define version in one place (T226)
    * Prevent invalid free when using different C runtimes than OpenSSL (T229)
    * Compatibility improvements to testsuite

    Update to version 0.9.4:

    * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/
    * Fix possible Denial of Service attack when using AES-CTR-ciphers       CVE-2020-1730 (bsc#1168699)

    Update to version 0.9.3:

    * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095)
    * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state
    * SSH-01-006 General: Various unchecked Null-derefs cause DOS
    * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys
    * SSH-01-010 SSH: Deprecated hash function in fingerprinting
    * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS
    * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access
    * SSH-01-001 State Machine: Initial machine states should be set explicitly
    * SSH-01-002 Kex: Differently bound macros used to iterate same array
    * SSH-01-005 Code-Quality: Integer sign confusion during assignments
    * SSH-01-008 SCP: Protocol Injection via unescaped File Names
    * SSH-01-009 SSH: Update documentation which RFCs are implemented
    * SSH-01-012 PKI: Information leak via uninitialized stack buffer

    Update to version 0.9.2:

    * Fixed libssh-config.cmake
    * Fixed issues with rsa algorithm negotiation (T191)
    * Fixed detection of OpenSSL ed25519 support (T197)

    Update to version 0.9.1:

    * Added support for Ed25519 via OpenSSL
    * Added support for X25519 via OpenSSL
    * Added support for localuser in Match keyword
    * Fixed Match keyword to be case sensitive
    * Fixed compilation with LibreSSL
    * Fixed error report of channel open (T75)
    * Fixed sftp documentation (T137)
    * Fixed known_hosts parsing (T156)
    * Fixed build issue with MinGW (T157)
    * Fixed build with gcc 9 (T164)
    * Fixed deprecation issues (T165)
    * Fixed known_hosts directory creation (T166)

    Update to verion 0.9.0:

    * Added support for AES-GCM
    * Added improved rekeying support
    * Added performance improvements
    * Disabled blowfish support by default
    * Fixed several ssh config parsing issues
    * Added support for DH Group Exchange KEX
    * Added support for Encrypt-then-MAC mode
    * Added support for parsing server side configuration file
    * Added support for ECDSA/Ed25519 certificates
    * Added FIPS 140-2 compatibility
    * Improved known_hosts parsing
    * Improved documentation
    * Improved OpenSSL API usage for KEX, DH, and signatures

    - Add libssh client and server config files

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
135452	openSUSE Security Update : libssh (openSUSE-2020-510)	Nessus	SuSE Local Security Checks	2020/4/14	2026/2/24	medium
135399	Ubuntu 18.04 LTS : libssh vulnerability (USN-4327-1)	Nessus	Ubuntu Local Security Checks	2020/4/10	2026/2/24	medium
135392	SUSE SLED15 / SLES15 Security Update : libssh (SUSE-SU-2020:0967-1)	Nessus	SuSE Local Security Checks	2020/4/10	2026/2/24	medium
135393	SUSE SLES12 Security Update : libssh (SUSE-SU-2020:0968-1)	Nessus	SuSE Local Security Checks	2020/4/10	2026/2/24	medium
157706	AlmaLinux 8 : libssh (ALSA-2020:4545)	Nessus	Alma Linux Local Security Checks	2022/2/9	2026/2/24	high
236741	Alibaba Cloud Linux 3 : 0067: libssh (ALINUX3-SA-2022:0067)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
147245	NewStart CGSL MAIN 6.02 : libssh Multiple Vulnerabilities (NS-SA-2021-0069)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2023/2/2	high
190754	SUSE SLES15 Security Update : libssh (SUSE-SU-2024:0525-1)	Nessus	SuSE Local Security Checks	2024/2/20	2026/6/25	medium
135742	EulerOS 2.0 SP8 : libssh (EulerOS-SA-2020-1509)	Nessus	Huawei Local Security Checks	2020/4/20	2026/2/24	medium
142768	Oracle Linux 8 : libssh (ELSA-2020-4545)	Nessus	Oracle Linux Local Security Checks	2020/11/12	2024/11/1	high
135426	GLSA-202004-08 : libssh: Denial of service	Nessus	Gentoo Local Security Checks	2020/4/14	2026/2/24	medium
137806	EulerOS Virtualization for ARM 64 3.0.6.0 : libssh (EulerOS-SA-2020-1699)	Nessus	Huawei Local Security Checks	2020/6/25	2021/1/6	medium
184231	F5 Networks BIG-IP : libssh vulnerability (K05295501)	Nessus	F5 Networks Local Security Checks	2023/11/2	2024/5/7	medium
143238	RHEL 8 : Red Hat Virtualization (RHSA-2020:5218)	Nessus	Red Hat Local Security Checks	2020/11/24	2026/2/24	medium
206832	NewStart CGSL MAIN 6.02 : libssh Multiple Vulnerabilities (NS-SA-2024-0052)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2026/2/24	critical
142391	RHEL 8 : libssh (RHSA-2020:4545)	Nessus	Red Hat Local Security Checks	2020/11/4	2026/2/24	high
190835	SUSE SLES12 Security Update : libssh (SUSE-SU-2024:0539-1)	Nessus	SuSE Local Security Checks	2024/2/21	2026/6/26	medium

检测

插件搜索

medium

medium

medium

medium

high

high

high

medium

medium

high

medium

medium

medium

medium

critical

high

medium