File _patchinfo of Package patchinfo.32500

<patchinfo incident="32500">
  <issue tracker="jsc" id="PED-7719"/>
  <issue tracker="bnc" id="1158095">VUL-0: CVE-2019-14889: libssh: unsanitized location in scp could lead to unwanted command execution</issue>
  <issue tracker="bnc" id="1168699">VUL-0: CVE-2020-1730: libssh: possible segfault when zeroing AES-CTR  key</issue>
  <issue tracker="bnc" id="1174713">VUL-1: CVE-2020-16135: libssh: NULL pointer dereference in sftpserver.c</issue>
  <issue tracker="bnc" id="1189608">VUL-0: CVE-2021-3634: libssh: Possible heap-buffer overflow when rekeying</issue>
  <issue tracker="bnc" id="1211188">VUL-0: CVE-2023-1667: libssh: NULL pointer dereference during rekeying with algorithm guessing</issue>
  <issue tracker="bnc" id="1211190">VUL-0: CVE-2023-2283: libssh: authorization bypass in pki_verify_data_signature</issue>
  <issue tracker="bnc" id="1218126">VUL-0: CVE-2023-48795: libssh: prefix truncation breaking ssh channel integrity</issue>
  <issue tracker="bnc" id="1218186">VUL-0: CVE-2023-6918: libssh: Missing checks for return values for digests</issue>
  <issue tracker="bnc" id="1218209">VUL-0: CVE-2023-6004: libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname</issue>
  <issue tracker="cve" id="2020-1730"/>
  <issue tracker="cve" id="2023-6918"/>
  <issue tracker="cve" id="2023-1667"/>
  <issue tracker="cve" id="2023-48795"/>
  <issue tracker="cve" id="2023-6004"/>
  <issue tracker="cve" id="2020-16135"/>
  <issue tracker="cve" id="2019-14889"/>
  <issue tracker="cve" id="2023-2283"/>
  <issue tracker="cve" id="2021-3634"/>
  <packager>pmonrealgonzalez</packager>
  <rating>important</rating>
  <category>security</category>
  <summary>Security update for libssh</summary>
  <description>This update for libssh fixes the following issues:

Update to version 0.9.8 (jsc#PED-7719):

* Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209)
* Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126)
* Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186)
* Allow @ in usernames when parsing from URI composes

Update to version 0.9.7:

* Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm
  guessing (bsc#1211188)
* Fix CVE-2023-2283: a possible authorization bypass in
  pki_verify_data_signature under low-memory conditions (bsc#1211190)
* Fix several memory leaks in GSSAPI handling code

Update to version 0.9.6 (bsc#1189608, CVE-2021-3634):

* https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6


Update to 0.9.5 (bsc#1174713, CVE-2020-16135):

* CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232)
* Improve handling of library initialization (T222)
* Fix parsing of subsecond times in SFTP (T219)
* Make the documentation reproducible
* Remove deprecated API usage in OpenSSL
* Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN
* Define version in one place (T226)
* Prevent invalid free when using different C runtimes than OpenSSL (T229)
* Compatibility improvements to testsuite 

Update to version 0.9.4

* https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/
* Fix possible Denial of Service attack when using AES-CTR-ciphers
  CVE-2020-1730 (bsc#1168699)

Update to version 0.9.3

* Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095)
* SSH-01-003 Client: Missing NULL check leads to crash in erroneous state
* SSH-01-006 General: Various unchecked Null-derefs cause DOS
* SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys
* SSH-01-010 SSH: Deprecated hash function in fingerprinting
* SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS
* SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access
* SSH-01-001 State Machine: Initial machine states should be set explicitly
* SSH-01-002 Kex: Differently bound macros used to iterate same array
* SSH-01-005 Code-Quality: Integer sign confusion during assignments
* SSH-01-008 SCP: Protocol Injection via unescaped File Names
* SSH-01-009 SSH: Update documentation which RFCs are implemented
* SSH-01-012 PKI: Information leak via uninitialized stack buffer

Update to version 0.9.2

* Fixed libssh-config.cmake
* Fixed issues with rsa algorithm negotiation (T191)
* Fixed detection of OpenSSL ed25519 support (T197)

Update to version 0.9.1

* Added support for Ed25519 via OpenSSL
* Added support for X25519 via OpenSSL
* Added support for localuser in Match keyword
* Fixed Match keyword to be case sensitive
* Fixed compilation with LibreSSL
* Fixed error report of channel open (T75)
* Fixed sftp documentation (T137)
* Fixed known_hosts parsing (T156)
* Fixed build issue with MinGW (T157)
* Fixed build with gcc 9 (T164)
* Fixed deprecation issues (T165)
* Fixed known_hosts directory creation (T166)

- Split out configuration to separate package to not mess up the
  library packaging and coinstallation

Update to verion 0.9.0

* Added support for AES-GCM
* Added improved rekeying support
* Added performance improvements
* Disabled blowfish support by default
* Fixed several ssh config parsing issues
* Added support for DH Group Exchange KEX
* Added support for Encrypt-then-MAC mode
* Added support for parsing server side configuration file
* Added support for ECDSA/Ed25519 certificates
* Added FIPS 140-2 compatibility
* Improved known_hosts parsing
* Improved documentation
* Improved OpenSSL API usage for KEX, DH, and signatures

- Add libssh client and server config files
</description>
</patchinfo>
Places

File _patchinfo of Package patchinfo.32500

Places
