vulnerability
Oracle Linux: CVE-2023-2283: ELSA-2023-3839: libssh security update (MODERATE) (Multiple Advisories)
Severity | CVSS | Published | Added | Modified |
---|---|---|---|---|
4 | (AV:N/AC:H/Au:N/C:P/I:P/A:N) | May 5, 2023 | Jun 30, 2023 | Nov 30, 2024 |
Severity
4
CVSS
(AV:N/AC:H/Au:N/C:P/I:P/A:N)
Published
May 5, 2023
Added
Jun 30, 2023
Modified
Nov 30, 2024
Description
A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.
Solution(s)
oracle-linux-upgrade-libsshoracle-linux-upgrade-libssh-configoracle-linux-upgrade-libssh-devel

NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.