Withdrawn by the publisher.

A vulnerability in libssh could allow an unauthenticated, remote attacker to bypass authentication on a targeted system. The vulnerability is due to improper authentication operations by the server-side state machine of the affected software. An attacker could exploit this vulnerability by presenting a SSH2_MSG_USERAUTH_SUCCESS message to a targeted system. A successful exploit could allow the attacker to bypass authentication and gain unauthorized access to a targeted system.

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

A vulnerability exists in a specific library included in these products. An attacker could exploit the vulnerability by sending a specially crafted message to the XMC20 node to open a communication channel without first performing authentication, resulting in unauthorized access.CVE-2018-10933 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

libssh-config-0.9.6-1.2 on GA media

libssh: Authentication Bypass due to improper message callbacks implementation

Security update for libssh

Affected: Ubuntu:14.04:LTS: libssh, Ubuntu:16.04:LTS: libssh, Ubuntu:18.04:LTS: libssh

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in libssh ausnutzen, um Sicherheitsvorkehrungen zu umgehen.