Skip to content
OpenAdvisories
Medium ALSA-2023:3839 2 CVEs

Moderate: libssh security update

Published Jun 27, 2023 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.

Security Fix(es):

* libssh: NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667)
* libssh: authorization bypass in pki_verify_data_signature (CVE-2023-2283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 3

ReleasePackageFixed in
AlmaLinux · 8 libssh 0.9.6-10.el8_8
AlmaLinux · 8 libssh-config 0.9.6-10.el8_8
AlmaLinux · 8 libssh-devel 0.9.6-10.el8_8

Vulnerabilities 2

  • Unscored —
    CVE-2023-1667

    A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authen…

    libssh libssh Debian Ubuntu
  • Unscored —
    CVE-2023-2283

    A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki…

    libssh libssh Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2023-1667
  • report
    https://access.redhat.com/security/cve/CVE-2023-2283
  • report
    https://bugzilla.redhat.com/2182199
  • report
    https://bugzilla.redhat.com/2189736
  • advisory
    https://errata.almalinux.org/8/ALSA-2023-3839.html