The remote host is affected by the vulnerability described in GLSA-202312-05 (libssh: Multiple Vulnerabilities)

  - A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared     secrets during the lifetime of the session. One of them is called secret_hash and the other session_id.
    Initially, both of them are the same, but after key re-exchange, previous session_id is kept and used as     an input to new secret_hash. Historically, both of these buffers had shared length variable, which worked     as long as these buffers were same. But the key re-exchange operation can also change the key exchange     method, which can be based on hash of different size, eventually creating secret_hash of different size     than the session_id has. This becomes an issue when the session_id memory is zeroed or when it is used     again during second key re-exchange. (CVE-2021-3634)

  - A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may     allow an authenticated client to cause a denial of service. (CVE-2023-1667)

  - A vulnerability was found in libssh, where the authentication check of the connecting client can be     bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen     if there is insufficient memory or the memory usage is limited. The problem is caused by the return value     `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call     `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the     cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.
    (CVE-2023-2283)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to AHV-10.0. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.0 advisory.

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and     1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files     outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.
    When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the     command-line interface), that means that an application which otherwise doesn't have access to the real     user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the     scenes, this directory is actually a bind mount and the data is stored in the per-application directory as     `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory     to still work as intended without general home directory access. However, the application does have write     access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source     directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the     application is started, the bind mount will follow the symlink and mount whatever it points to into the     sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the     patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by     two instances of a malicious app running in parallel. Closing the race condition requires updating or     patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the     patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with     `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar     option, then the version of bubblewrap that needs to be patched is a system copy that is distributed     separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux     distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with     `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is     included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`.
    This configuration is the default when building from source code. For the 1.14.x stable branch, these     changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has     been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10.
    The bundled version of bubblewrap in this release is a Meson wrap subproject, which has been updated to     0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS     distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or     update to newer versions if their stability policy allows it. As a workaround, avoid using applications     using the `persistent` (`--persist`) permission. (CVE-2024-42472)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libssh package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may     allow an authenticated client to cause a denial of service. (CVE-2023-1667)

  - A vulnerability was found in libssh, where the authentication check of the connecting client can be     bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen     if there is insufficient memory or the memory usage is limited. The problem is caused by the return value     `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call     `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the     cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.
    (CVE-2023-2283)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of libssh installed on the remote host is prior to 0.10.5. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-124-01 advisory.

  - A vulnerability was found in libssh, where the authentication check of the connecting client can be     bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen     if there is insufficient memory or the memory usage is limited. The problem is caused by the return value     `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call     `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the     cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.
    (CVE-2023-2283)

  - A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may     allow an authenticated client to cause a denial of service. (CVE-2023-1667)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.1 / 17.5.1.4 / 21.0.0. It is, therefore, affected by a vulnerability as referenced in the K000148495 advisory.

    A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may     allow an authenticated client to cause a denial of service.(CVE-2023-1667)

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-5fa5ca2043 advisory.

    Update to 0.10.5 (CVE-2023-1667 CVE-2023-2283)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6643 advisory.

    - Fix CVE-2023-1667 and CVE-2023-2283

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3839 advisory.

    libssh is a library which implements the SSH protocol. It can be used to implement client and server     applications.

    Security Fix(es):

    * libssh: NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667)

    * libssh: authorization bypass in pki_verify_data_signature (CVE-2023-2283)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6138-1 advisory.

    Philip Turnbull discovered that libssh incorrectly handled rekeying with algorithm guessing. A remote     attacker could use this issue to cause libssh to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2023-1667)

    Kevin Backhouse discovered that libssh incorrectly handled verifying data signatures. A remote attacker     could possibly use this issue to bypass authorization. (CVE-2023-2283)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3437 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3437-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     May 29, 2023                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libssh     Version        : 0.8.7-1+deb10u2     CVE ID         : CVE-2019-14889 CVE-2023-1667     Debian Bug     : 946548 1035832

    Two security issues have been discovered in libssh, a tiny C SSH     library, which may allows an remote authenticated user to cause a denial     of service or inject arbitrary commands.

    CVE-2019-14889

        A flaw was found with the libssh API function ssh_scp_new() in         versions before 0.9.3 and before 0.8.8. When the libssh SCP client         connects to a server, the scp command, which includes a         user-provided path, is executed on the server-side. In case the         library is used in a way where users can influence the third         parameter of the function, it would become possible for an attacker         to inject arbitrary commands, leading to a compromise of the remote         target.

    CVE-2023-1667

        A NULL pointer dereference was found In libssh during re-keying with         algorithm guessing. This issue may allow an authenticated client to         cause a denial of service.

    For Debian 10 buster, these problems have been fixed in version     0.8.7-1+deb10u2.

    We recommend that you upgrade your libssh packages.

    For the detailed security status of libssh please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libssh

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0538 advisory.

    libssh is a library which implements the SSH protocol. It can be used to implement client and server     applications.

    Security Fix(es):

    * libssh: NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667)

    * libssh: authorization bypass in pki_verify_data_signature (CVE-2023-2283)

    * ssh: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0539-1 advisory.

    Update to version 0.9.8 (jsc#PED-7719):

    * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209)
    * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126)
    * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186)
    * Allow @ in usernames when parsing from URI composes

    Update to version 0.9.7

    * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm       guessing (bsc#1211188)
    * Fix CVE-2023-2283: a possible authorization bypass in       pki_verify_data_signature under low-memory conditions (bsc#1211190)
    * Fix several memory leaks in GSSAPI handling code

    Update to version 0.9.6 (bsc#1189608, CVE-2021-3634)

    * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6

    Update to version 0.9.5 (bsc#1174713, CVE-2020-16135):

    * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232)
    * Improve handling of library initialization (T222)
    * Fix parsing of subsecond times in SFTP (T219)
    * Make the documentation reproducible
    * Remove deprecated API usage in OpenSSL
    * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN
    * Define version in one place (T226)
    * Prevent invalid free when using different C runtimes than OpenSSL (T229)
    * Compatibility improvements to testsuite

    Update to version 0.9.4:

    * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/
    * Fix possible Denial of Service attack when using AES-CTR-ciphers       CVE-2020-1730 (bsc#1168699)

    Update to version 0.9.3:

    * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095)
    * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state
    * SSH-01-006 General: Various unchecked Null-derefs cause DOS
    * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys
    * SSH-01-010 SSH: Deprecated hash function in fingerprinting
    * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS
    * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access
    * SSH-01-001 State Machine: Initial machine states should be set explicitly
    * SSH-01-002 Kex: Differently bound macros used to iterate same array
    * SSH-01-005 Code-Quality: Integer sign confusion during assignments
    * SSH-01-008 SCP: Protocol Injection via unescaped File Names
    * SSH-01-009 SSH: Update documentation which RFCs are implemented
    * SSH-01-012 PKI: Information leak via uninitialized stack buffer

    Update to version 0.9.2:

    * Fixed libssh-config.cmake
    * Fixed issues with rsa algorithm negotiation (T191)
    * Fixed detection of OpenSSL ed25519 support (T197)

    Update to version 0.9.1:

    * Added support for Ed25519 via OpenSSL
    * Added support for X25519 via OpenSSL
    * Added support for localuser in Match keyword
    * Fixed Match keyword to be case sensitive
    * Fixed compilation with LibreSSL
    * Fixed error report of channel open (T75)
    * Fixed sftp documentation (T137)
    * Fixed known_hosts parsing (T156)
    * Fixed build issue with MinGW (T157)
    * Fixed build with gcc 9 (T164)
    * Fixed deprecation issues (T165)
    * Fixed known_hosts directory creation (T166)

    Update to verion 0.9.0:

    * Added support for AES-GCM
    * Added improved rekeying support
    * Added performance improvements
    * Disabled blowfish support by default
    * Fixed several ssh config parsing issues
    * Added support for DH Group Exchange KEX
    * Added support for Encrypt-then-MAC mode
    * Added support for parsing server side configuration file
    * Added support for ECDSA/Ed25519 certificates
    * Added FIPS 140-2 compatibility
    * Improved known_hosts parsing
    * Improved documentation
    * Improved OpenSSL API usage for KEX, DH, and signatures

    - Add libssh client and server config files

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may     allow an authenticated client to cause a denial of service. (CVE-2023-1667)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
187202	GLSA-202312-05 : libssh: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2023/12/22	2023/12/22	medium
310786	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.0)	Nessus	Misc.	2026/4/29	2026/4/30	medium
179279	EulerOS Virtualization 2.10.1 : libssh (EulerOS-SA-2023-2542)	Nessus	Huawei Local Security Checks	2023/8/2	2023/12/22	medium
175121	Slackware Linux 14.2 / 15.0 / current libssh Multiple Vulnerabilities (SSA:2023-124-01)	Nessus	Slackware Local Security Checks	2023/5/4	2023/12/22	medium
211737	F5 Networks BIG-IP : libssh vulnerability (K000148495)	Nessus	F5 Networks Local Security Checks	2024/11/22	2026/2/3	medium
188755	EulerOS Virtualization 2.9.1 : libssh (EulerOS-SA-2023-2959)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
188782	EulerOS Virtualization 2.9.0 : libssh (EulerOS-SA-2023-2985)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
176439	Fedora 37 : libssh (2023-5fa5ca2043)	Nessus	Fedora Local Security Checks	2023/5/28	2024/11/14	medium
185834	Oracle Linux 9 : libssh (ELSA-2023-6643)	Nessus	Oracle Linux Local Security Checks	2023/11/16	2025/9/9	medium
177659	RHEL 8 : libssh (RHSA-2023:3839)	Nessus	Red Hat Local Security Checks	2023/6/27	2024/11/7	medium
176712	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : libssh vulnerabilities (USN-6138-1)	Nessus	Ubuntu Local Security Checks	2023/6/5	2024/8/27	medium
176464	Debian dla-3437 : libssh-4 - security update	Nessus	Debian Local Security Checks	2023/5/30	2025/1/22	high
189743	RHEL 8 : libssh (RHSA-2024:0538)	Nessus	Red Hat Local Security Checks	2024/1/29	2026/1/21	critical
190835	SUSE SLES12 Security Update : libssh (SUSE-SU-2024:0539-1)	Nessus	SuSE Local Security Checks	2024/2/21	2026/6/26	medium
259767	Linux Distros Unpatched Vulnerability : CVE-2023-1667	Nessus	Misc.	2025/8/30	2026/7/27	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

critical

medium

medium