The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:2031 advisory.

  - A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared     secrets during the lifetime of the session. One of them is called secret_hash and the other session_id.
    Initially, both of them are the same, but after key re-exchange, previous session_id is kept and used as     an input to new secret_hash. Historically, both of these buffers had shared length variable, which worked     as long as these buffers were same. But the key re-exchange operation can also change the key exchange     method, which can be based on hash of different size, eventually creating secret_hash of different size     than the session_id has. This becomes an issue when the session_id memory is zeroed or when it is used     again during second key re-exchange. (CVE-2021-3634)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has libssh packages installed that are affected by multiple vulnerabilities:

  - The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state     of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children     processes and allows local users to obtain sensitive information by leveraging a pid collision.
    (CVE-2014-0017)

  - A vulnerability was found in libssh's server-side state machine. A malicious client could create channels     without first performing authentication, resulting in unauthorized access. (CVE-2018-10933)

  - A flaw was found with the libssh API function ssh_scp_new(). A user able to connect to a server using SCP     could execute arbitrary command using a user-provided path, leading to a compromise of the remote target.
    (CVE-2019-14889)

  - A flaw was found in libssh. A NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
    (CVE-2020-16135)

  - A flaw was found in the way libssh handled AES-CTR (or DES ciphers if enabled) ciphers. The server or     client could crash when the connection hasn't been fully initialized and the system tries to cleanup the     ciphers when closing the connection. The biggest threat from this vulnerability is system availability.
    (CVE-2020-1730)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0539-1 advisory.

    Update to version 0.9.8 (jsc#PED-7719):

    * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209)
    * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126)
    * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186)
    * Allow @ in usernames when parsing from URI composes

    Update to version 0.9.7

    * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm       guessing (bsc#1211188)
    * Fix CVE-2023-2283: a possible authorization bypass in       pki_verify_data_signature under low-memory conditions (bsc#1211190)
    * Fix several memory leaks in GSSAPI handling code

    Update to version 0.9.6 (bsc#1189608, CVE-2021-3634)

    * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6

    Update to version 0.9.5 (bsc#1174713, CVE-2020-16135):

    * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232)
    * Improve handling of library initialization (T222)
    * Fix parsing of subsecond times in SFTP (T219)
    * Make the documentation reproducible
    * Remove deprecated API usage in OpenSSL
    * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN
    * Define version in one place (T226)
    * Prevent invalid free when using different C runtimes than OpenSSL (T229)
    * Compatibility improvements to testsuite

    Update to version 0.9.4:

    * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/
    * Fix possible Denial of Service attack when using AES-CTR-ciphers       CVE-2020-1730 (bsc#1168699)

    Update to version 0.9.3:

    * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095)
    * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state
    * SSH-01-006 General: Various unchecked Null-derefs cause DOS
    * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys
    * SSH-01-010 SSH: Deprecated hash function in fingerprinting
    * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS
    * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access
    * SSH-01-001 State Machine: Initial machine states should be set explicitly
    * SSH-01-002 Kex: Differently bound macros used to iterate same array
    * SSH-01-005 Code-Quality: Integer sign confusion during assignments
    * SSH-01-008 SCP: Protocol Injection via unescaped File Names
    * SSH-01-009 SSH: Update documentation which RFCs are implemented
    * SSH-01-012 PKI: Information leak via uninitialized stack buffer

    Update to version 0.9.2:

    * Fixed libssh-config.cmake
    * Fixed issues with rsa algorithm negotiation (T191)
    * Fixed detection of OpenSSL ed25519 support (T197)

    Update to version 0.9.1:

    * Added support for Ed25519 via OpenSSL
    * Added support for X25519 via OpenSSL
    * Added support for localuser in Match keyword
    * Fixed Match keyword to be case sensitive
    * Fixed compilation with LibreSSL
    * Fixed error report of channel open (T75)
    * Fixed sftp documentation (T137)
    * Fixed known_hosts parsing (T156)
    * Fixed build issue with MinGW (T157)
    * Fixed build with gcc 9 (T164)
    * Fixed deprecation issues (T165)
    * Fixed known_hosts directory creation (T166)

    Update to verion 0.9.0:

    * Added support for AES-GCM
    * Added improved rekeying support
    * Added performance improvements
    * Disabled blowfish support by default
    * Fixed several ssh config parsing issues
    * Added support for DH Group Exchange KEX
    * Added support for Encrypt-then-MAC mode
    * Added support for parsing server side configuration file
    * Added support for ECDSA/Ed25519 certificates
    * Added FIPS 140-2 compatibility
    * Improved known_hosts parsing
    * Improved documentation
    * Improved OpenSSL API usage for KEX, DH, and signatures

    - Add libssh client and server config files

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libssh package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared     secrets during the lifetime of the session. One of them is called secret_hash and the other session_id.
    Initially, both of them are the same, but after key re-exchange, previous session_id is kept and used as     an input to new secret_hash. Historically, both of these buffers had shared length variable, which worked     as long as these buffers were same. But the key re-exchange operation can also change the key exchange     method, which can be based on hash of different size, eventually creating 'secret_hash' of different size     than the session_id has. This becomes an issue when the session_id memory is zeroed or when it is used     again during second key re-exchange. (CVE-2021-3634)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle MySQL Workbench installed on the remote Windows host is prior to 8.0.28. It is, therefore, affected by a vulnerability in the MySQL Workbench product of Oracle MySQL (component: Workbench: libssh). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via MySQL Workbench to compromise MySQL Workbench. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Workbench.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2022:0204 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-3634:
    A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared     secrets during the lifetime of the session. One of them is called secret_hash and the other session_id.
    Initially, both of them are the same, but after key re-exchange, previous session_id is kept and used as     an input to new secret_hash. Historically, both of these buffers had shared length variable, which worked     as long as these buffers were same. But the key re-exchange operation can also change the key exchange     method, which can be based on hash of different size, eventually creating secret_hash of different size     than the session_id has. This becomes an issue when the session_id memory is zeroed or when it is used     again during second key re-exchange.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3399:01 advisory.

    * libssh: possible heap-based buffer overflow when rekeying (CVE-2021-3634)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
161351	Rocky Linux 8 : libssh (RLSA-2022:2031)	Nessus	Rocky Linux Local Security Checks	2022/5/18	2023/11/7	medium
206832	NewStart CGSL MAIN 6.02 : libssh Multiple Vulnerabilities (NS-SA-2024-0052)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2026/2/24	critical
190835	SUSE SLES12 Security Update : libssh (SUSE-SU-2024:0539-1)	Nessus	SuSE Local Security Checks	2024/2/21	2026/6/26	medium
155268	EulerOS 2.0 SP9 : libssh (EulerOS-SA-2021-2691)	Nessus	Huawei Local Security Checks	2021/11/11	2023/10/6	medium
156885	Oracle MySQL Workbench < 8.0.28 (Jan 2022)	Nessus	Windows	2022/1/20	2023/10/6	medium
236308	Alibaba Cloud Linux 3 : 0204: libssh (ALINUX3-SA-2022:0204)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium
291725	MiracleLinux 8 : libssh-0.9.6-3.el8 (AXSA:2022-3399:01)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	medium

检测

插件搜索

medium

critical

medium

medium

medium

medium

medium