Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-7598: A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libssh2 | 0:1.10.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | libssh2-debuginfo | 0:1.10.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | libssh2-debugsource | 0:1.10.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | libssh2-devel | 0:1.10.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | libssh2-docs | 0:1.10.0-1.amzn2023.0.4 |
Vulnerabilities 1
-
High 7.3
libssh2 userauth.c userauth_password integer overflow
A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be lau…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-7598.html