A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libssh-develUpgrade libsshUpgrade libssh-config | Jul 4, 2023 | May 26, 2023 |
| Amazon_linux_2023 | — | Upgrade libsshUpgrade libssh-debuginfoUpgrade libssh-debugsourceUpgrade libssh-configUpgrade libssh-devel | Feb 17, 2025 | May 5, 2023 |
| Centos_linux | — | Upgrade libssh-develUpgrade libssh-debuginfoUpgrade libsshUpgrade libssh-debugsourceUpgrade libssh-config | Jun 28, 2023 | May 26, 2023 |
| Debian | — | Upgrade libssh | May 24, 2023 | May 24, 2023 |
| Dell Powerstore Dsa2024398 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 17, 2024 |
| Dell Powerstore Dsa2024408 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Sep 26, 2024 |
| Dell Powerstore Dsa2024432 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 29, 2024 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 24, 2024 |
| Gentoo Linux | — | Upgrade net-libs/libssh. | Dec 27, 2023 | May 26, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libssh | Jul 18, 2023 | May 26, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libssh | Jan 10, 2024 | May 26, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libssh | Aug 9, 2023 | May 26, 2023 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 22, 2023 |
| Oracle_linux | — | Upgrade libsshUpgrade libssh-configUpgrade libssh-devel | Jun 30, 2023 | May 5, 2023 |
| Redhat_linux | — | No solution existsUpgrade libssh-configUpgrade libsshUpgrade libssh-debugsourceUpgrade libssh-debuginfoUpgrade libssh-devel | Jun 28, 2023 | May 26, 2023 |
| Rocky_linux | — | Upgrade libsshUpgrade libssh-debugsourceUpgrade libssh-develUpgrade libssh-debuginfo | Mar 5, 2024 | May 26, 2023 |
| Suse | — | Upgrade libssh4-32bitUpgrade libssh-configUpgrade libssh-develUpgrade libssh4 | Jan 19, 2024 | May 26, 2023 |
| Ubuntu | — | Upgrade libssh-4 | Jun 6, 2023 | May 26, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 26, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub