https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 04:21:09 +0000 https://cve.radiocsirt.org/vuln/alsa-2023:3839 <p><strong>Affected:</strong> AlmaLinux:8: libssh, AlmaLinux:8: libssh-config, AlmaLinux:8: libssh-devel</p> <p>libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.</p> <p>Security Fix(es):</p> <p>* libssh: NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667) * libssh: authorization bypass in pki_verify_data_signature (CVE-2023-2283)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: libssh, AlmaLinux:8: libssh-config, AlmaLinux:8: libssh-devel</p> <p>libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.</p> <p>Security Fix(es):</p> <p>* libssh: NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667) * libssh: authorization bypass in pki_verify_data_signature (CVE-2023-2283)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2023:3839 https://cve.radiocsirt.org/vuln/bdu:2023-05381 bdu:2023-05381 https://cve.radiocsirt.org/vuln/bdu:2023-05381 https://cve.radiocsirt.org/vuln/bell-cve-2023-2283 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2023-2283 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0686 certfr-2023-avi-0686 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0686 https://cve.radiocsirt.org/vuln/euvd-2026-258065 EUVD-2026-258065 https://cve.radiocsirt.org/vuln/euvd-2026-258065 https://cve.radiocsirt.org/vuln/fkie_cve-2023-2283 <p>A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.</p> <p>A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-2283 https://cve.radiocsirt.org/vuln/ghsa-h9jw-g3xj-5hwg <p>A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.</p> <p>A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.</p> https://cve.radiocsirt.org/vuln/ghsa-h9jw-g3xj-5hwg https://cve.radiocsirt.org/vuln/gsd-2023-2283 gsd-2023-2283 https://cve.radiocsirt.org/vuln/gsd-2023-2283 https://cve.radiocsirt.org/vuln/oesa-2023-1291 <p><strong>Affected:</strong> openEuler:22.03-LTS: libssh</p> <p>The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl). Security Fix(es): A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.(CVE-2023-1667) A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.(CVE-2023-2283)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS: libssh</p> <p>The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl). Security Fix(es): A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.(CVE-2023-1667) A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.(CVE-2023-2283)</p> https://cve.radiocsirt.org/vuln/oesa-2023-1291 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12914-1 <p>libssh-config-0.10.5-1.1 on GA media</p> <p>libssh-config-0.10.5-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:12914-1 https://cve.radiocsirt.org/vuln/rhsa-2024:0538 <p>libssh: NULL pointer dereference during rekeying with algorithm guessing libssh: authorization bypass in pki_verify_data_signature ssh: Prefix truncation attack on Binary Packet Protocol (BPP)</p> <p>libssh: NULL pointer dereference during rekeying with algorithm guessing libssh: authorization bypass in pki_verify_data_signature ssh: Prefix truncation attack on Binary Packet Protocol (BPP)</p> https://cve.radiocsirt.org/vuln/rhsa-2024:0538 https://cve.radiocsirt.org/vuln/suse-su-2024:0525-1 <p>Security update for libssh</p> <p>Security update for libssh</p> https://cve.radiocsirt.org/vuln/suse-su-2024:0525-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-2283 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: libssh, Ubuntu:22.04:LTS: libssh</p> <p>A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: libssh, Ubuntu:22.04:LTS: libssh</p> <p>A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-2283 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1159 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in libssh ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in libssh ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1159