Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-0967: libssh: Specially crafted patterns could cause DoS CVE-2026-0964: libssh: SCP Protocol Path Traversal in ssh_scp_pull_request()
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libssh | 0:0.10.6-1.amzn2023.0.5 |
| Amazon Linux · 2023 | libssh-config | 0:0.10.6-1.amzn2023.0.5 |
| Amazon Linux · 2023 | libssh-debuginfo | 0:0.10.6-1.amzn2023.0.5 |
| Amazon Linux · 2023 | libssh-debugsource | 0:0.10.6-1.amzn2023.0.5 |
| Amazon Linux · 2023 | libssh-devel | 0:0.10.6-1.amzn2023.0.5 |
Vulnerabilities 2
-
Medium 5.0
Libssh: improper sanitation of paths received from scp servers
A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specifi…
-
Low 2.2
Libssh: libssh: denial of service via inefficient regular expression processing
A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This c…