Description
A vulnerability, which was classified as critical, has been found in sslh. This issue affects the function hexdump of the file probe.c of the component Packet Dumping Handler. The manipulation of the argument msg_info leads to format string. The attack may be initiated remotely. The name of the patch is b19f8a6046b080e4c2e28354a58556bb26040c6f. It is recommended to apply a patch to fix this issue. The identifier VDB-216497 was assigned to this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | sslh | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | sslh | No fix yet | — |
| Ubuntu 26.04 LTS | sslh | No fix yet | — |
| Ubuntu 25.10 | sslh | No fix yet | — |
| Ubuntu 22.04 LTS | sslh | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | sslh | No fix yet | — |
| Ubuntu Pro 20.04 LTS | sslh | No fix yet | — |
| Ubuntu Pro 18.04 LTS | sslh | No fix yet | — |
| Ubuntu Pro 16.04 LTS | sslh | No fix yet | — |
Advisories 1
- WID-SEC-2023-1101 Google Android Patchday Mai 2023 BSI CERT-Bund (WID) · Sep 17, 2023