Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-5987: If there is an error in initializing ChaCha20 cipher with OpenSSL, an invalid error code is returned. This can happen if there is an heap exhaustion. This error is not correctly detected and could allow libssh to use partially initialized cipher context. This is caused by the mismatch of return value meaning from OpenSSL and libssh, where OpenSSL error (rv=0) aliases with SSH_OK (0) and is returned directly from the function chacha20_poly1305_set_key(). This will likely cause error somewhere down the road. CVE-2025-5351: pki_key_to_blob() can cause a double free on certain errors when using OpenSSL >= 3.0. The function is used by different other functions which allow to export public or private keys to blobs or base64. The function is using the variable params without resetting it to NULL after free. In case of low-memory conditions when the allocation of string fails, the libssh calls the OSSL_PARAM_free() with the same arguments, which will likely crash. CVE-2025-5318: An incorrect comparison check allows to read beyond bounds in the sftp_handle() in the sftp server implementation. Thus an invalid pointer is returned as the handle and we try to continue using that. CVE-2025-4878: The privatekey_from_file() uses an uninitialized variable under certain conditions, such as if the file specified by the filename argument doesn't exist. This causes the code to return an invalid private key. This defect, in turn, might cause signing failure. The bug might also cause a Use-After-Free or corrupt the heap. Note that privatekey_from_file() is a deprecated function and shouldn't be used anymore!
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libssh | 0:0.10.6-1.amzn2023.0.2 |
| Amazon Linux · 2023 | libssh-config | 0:0.10.6-1.amzn2023.0.2 |
| Amazon Linux · 2023 | libssh-debuginfo | 0:0.10.6-1.amzn2023.0.2 |
| Amazon Linux · 2023 | libssh-debugsource | 0:0.10.6-1.amzn2023.0.2 |
| Amazon Linux · 2023 | libssh-devel | 0:0.10.6-1.amzn2023.0.2 |
Vulnerabilities 4
-
High 8.1
Libssh: invalid return code for chacha20 poly1305 with openssl backend
A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenS…
-
Medium 6.5
Libssh: double free vulnerability in libssh key export functions
A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a poten…
-
Medium 5.4
Libssh: out-of-bounds read in sftp_handle()
A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return …
-
Low 3.6
Libssh: use of uninitialized variable in privatekey_from_file()
A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failur…