Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-59850: A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions. CVE-2026-59848: A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service. CVE-2026-59847: A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection. CVE-2026-59846: A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior. CVE-2026-59845: A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service. CVE-2026-59844: A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libssh | 0:0.10.6-1.amzn2023.0.9 |
| Amazon Linux · 2023 | libssh-config | 0:0.10.6-1.amzn2023.0.9 |
| Amazon Linux · 2023 | libssh-debuginfo | 0:0.10.6-1.amzn2023.0.9 |
| Amazon Linux · 2023 | libssh-debugsource | 0:0.10.6-1.amzn2023.0.9 |
| Amazon Linux · 2023 | libssh-devel | 0:0.10.6-1.amzn2023.0.9 |
Vulnerabilities 6
-
Medium 6.5
Libssh: libssh: denial of service via oversized sftp read length
A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.
-
Medium 5.9
Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification
A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.
-
Medium 5.3
Libssh: libssh: denial of service via unchecked proxycommand fork() failure
A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.
-
Medium 5.3
Libssh: libssh: denial of service via sftp responses with unknown request ids
A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.
-
Medium 4.3
Libssh: libssh: use-after-free via data callbacks on closed channels
A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.
-
Low 3.9
Libssh: libssh: information disclosure via proxycommand %r username expansion
A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-59844.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-59845.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-59846.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-59847.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-59848.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-59850.html