UbuntuUpdates.org

Package "libssh-dev"

Name: libssh-dev

Description:

tiny C SSH library - Development files (OpenSSL flavor)
Latest version: 0.9.6-2ubuntu0.22.04.7
Release: jammy (22.04)
Level: security
Repository: main
Head package: libssh
Homepage: https://www.libssh.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libssh-dev"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libssh-dev" in Jammy

Repository Area Version
base main 0.9.6-2build1
updates main 0.9.6-2ubuntu0.22.04.7

Changelog

Version: 0.9.6-2ubuntu0.22.04.2 2023-12-19 16:08:33 UTC

  libssh (0.9.6-2ubuntu0.22.04.2) jammy-security; urgency=medium

  * SECURITY UPDATE: Prefix truncation attack on BPP
    - debian/patches/CVE-2023-48795-1.patch: add client side mitigation.
    - debian/patches/CVE-2023-48795-2.patch: add server side mitigations.
    - debian/patches/CVE-2023-48795-3.patch: strip extensions from both kex
      lists for matching.
    - debian/patches/CVE-2023-48795-4.patch: tests: adjust calculation to
      strict kex.
    - CVE-2023-48795

 -- Marc Deslauriers <email address hidden> Mon, 18 Dec 2023 17:30:05 -0500
Source diff to previous version
CVE-2023-48795 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integri

Version: 0.9.6-2ubuntu0.22.04.1 2023-06-05 16:07:22 UTC

  libssh (0.9.6-2ubuntu0.22.04.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Potential NULL dereference during rekeying with
    algorithm guessing
    - debian/patches/CVE-2023-1667-*.patch: upstream patches to fix the
      issue.
    - CVE-2023-1667
  * SECURITY UPDATE: Authorization bypass in pki_verify_data_signature
    - debian/patches/CVE-2023-2283-*.patch: upstream patches to fix the
      issue.
    - CVE-2023-2283

 -- Marc Deslauriers <email address hidden> Fri, 26 May 2023 06:31:25 -0400
CVE-2023-1667 A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a deni
CVE-2023-2283 A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` functi


About   -   Send Feedback to @ubuntu_updates