libssh: CVE-2023-1667 CVE-2023-2283

Debian Bug report logs - #1035832
libssh: CVE-2023-1667 CVE-2023-2283

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libssh: CVE-2023-1667 CVE-2023-2283

Date: Tue, 09 May 2023 22:30:26 +0200

Source: libssh
Version: 0.10.4-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 0.9.3-1
Control: found -1 0.9.5-1+deb11u1

Hi,

The following vulnerabilities were published for libssh.

CVE-2023-1667[0]:
| Potential NULL dereference during rekeying with algorithm guessing

CVE-2023-2283[1]:
| Authorization bypass in pki_verify_data_signature

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-1667
    https://www.cve.org/CVERecord?id=CVE-2023-1667
    https://www.libssh.org/security/advisories/CVE-2023-1667.txt
[1] https://security-tracker.debian.org/tracker/CVE-2023-2283
    https://www.cve.org/CVERecord?id=CVE-2023-2283
    https://www.libssh.org/security/advisories/CVE-2023-2283.txt

Regards,
Salvatore

Message #14 received at 1035832-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 1035832-close@bugs.debian.org

Subject: Bug#1035832: fixed in libssh 0.10.5-1

Date: Wed, 10 May 2023 06:20:12 +0000

Source: libssh
Source-Version: 0.10.5-1
Done: Martin Pitt <mpitt@debian.org>

We believe that the bug you reported is fixed in the latest version of
libssh, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1035832@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Martin Pitt <mpitt@debian.org> (supplier of updated libssh package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 10 May 2023 08:00:26 +0200
Source: libssh
Architecture: source
Version: 0.10.5-1
Distribution: unstable
Urgency: high
Maintainer: Laurent Bigonville <bigon@debian.org>
Changed-By: Martin Pitt <mpitt@debian.org>
Closes: 1035832
Changes:
 libssh (0.10.5-1) unstable; urgency=high
 .
   [ Martin Pitt ]
   * New upstream security release (thus high urgency):
     - Fix authenticated remote DoS through potential NULL dereference during rekeying
       with algorithm guessing (CVE-2023-1667)
       https://www.libssh.org/security/advisories/CVE-2023-1667.txt
     - Client authentication bypass in pki_verify_data_signature() in low-memory
       conditions with OpenSSL backend; gcrypt backend is not affected
       https://www.libssh.org/security/advisories/CVE-2023-2283.txt
       (CVE-2023-2283, Closes: #1035832)
   * Bump Standards-Version to 4.6.2. No changes necessary.
   * Drop debian/source/lintian-overrides. It now causes a "mismatched-override"
     warning, and apparently is not necessary any more.
   * debian/copyright: Drop files which don't exist any more.
     Spotted by lintian's "superfluous-file-pattern" warnings.
 .
   [ Debian Janitor ]
   * Bump debhelper from old 12 to 13.
   * Avoid explicitly specifying -Wl,--as-needed linker flag.
Checksums-Sha1:
 ddb59b6af4d50563b33b21973e1b2b0758b675c7 2742 libssh_0.10.5-1.dsc
 bc6b6858c3f4d07a302d838258d98e5bae790387 557776 libssh_0.10.5.orig.tar.xz
 dc55b86977ec5348d3048118c3beccd5d1b06da9 833 libssh_0.10.5.orig.tar.xz.asc
 d8d354cc003f4cc254f672fb968e13865059f00b 28016 libssh_0.10.5-1.debian.tar.xz
 29c7fbab76614a2fb35d9c473593912876904b1c 7413 libssh_0.10.5-1_source.buildinfo
Checksums-Sha256:
 2dbdceacadaa1ce6629bef199a44e2c89b9b220996337c858f54970914b4f4f0 2742 libssh_0.10.5-1.dsc
 b60e2ff7f367b9eee2b5634d3a63303ddfede0e6a18dfca88c44a8770e7e4234 557776 libssh_0.10.5.orig.tar.xz
 cc5427ac9480b30f87f7c3c2dca1830c1e7fe3c18503da2c07d4110150916c66 833 libssh_0.10.5.orig.tar.xz.asc
 06b785dde60a98934d56095834a41562a58039b034a2d7f1eb90bc633d84b83e 28016 libssh_0.10.5-1.debian.tar.xz
 6d2e8069eca275285bf54f9c8a5dc87571af90a02d8e69bc0741b80b9e0f6d48 7413 libssh_0.10.5-1_source.buildinfo
Files:
 63f682b498516dc66aa3059964baafca 2742 libs optional libssh_0.10.5-1.dsc
 d8db64ad57bbf25fc53396dd5438a3ef 557776 libs optional libssh_0.10.5.orig.tar.xz
 5216efd082214fa43e966115bb9502f8 833 libs optional libssh_0.10.5.orig.tar.xz.asc
 d8d8a5b28a9802a5ce080df8ecb31fed 28016 libs optional libssh_0.10.5-1.debian.tar.xz
 1d9dca270a1bb5fdaa7aba64f838cd19 7413 libs optional libssh_0.10.5-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEbEuHi35jHxYFV8PN7nvd5LhrVxMFAmRbMzAACgkQ7nvd5Lhr
VxPuEg//deLK4VLcee6GdodxblILU04rQ1ZC9GteXOKY3ApOgVYnUHwgJx3Js8OG
l5A5vBImnv+3wctnxEce4AXj76YrB2uKEH+LRFwCTqrSwfjmYVvw1OcpBiu6nJSi
GvPoJ+eZ7Om+WCxr/Rn7ainN3pejejMxTiPIV6HYIY6wMsV7zC1fqt8eLD82IDIw
jN/7xoSKmVto7IauGisKpOFCtgkkJe4rcnoZYUyqm9AyZvDvo8jootYbWPGs8MLi
waOuvPrKEtfpYE/A4TLAn6GAw/GUTFFeNi18orMXQCIzIHn2xvTOWBY8F5Zplrpa
SDWnH8AmEEp7OIGymQf30sHugYlFceqJcikem0/LyL6uLxROM2NfYcLcYisQPVdz
ebL+l+r4MV/mlAoqwlKy02ij5Vt4RtwTYM2x8QE+KHLYVCCZCBbJLLoFoDTepybG
QO7z+0iGFgwq6Ig3abalkI93qxd7Xd+FDFYFpacRhCkgxB99OuPQmoiyqEav7Rof
MV7G+cc4r7Xz1F0rhOlvF6tkxIBWoKMnmL6Ko37btAqFQlSohCODQt1KJtYKoEq+
tEBkBRFMFRGGRA7sULyKENBzCvXUV/Y6il+wCUpnsuhVQRpX+Hm1xJxOJHoSKRKR
7QJ0GPrOWlzmEqCnJSAdrtyUz27NQ+DWS/QTNT8zTFwSPceHow4=
=x/4l
-----END PGP SIGNATURE-----

Message #19 received at 1035832@bugs.debian.org (full text, mbox, reply):

From: Martin Pitt <mpitt@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 1035832@bugs.debian.org

Cc: security@debian.org

Subject: Re: Bug#1035832: libssh: CVE-2023-1667 CVE-2023-2283

Date: Wed, 10 May 2023 08:19:42 +0200

Control: tag -1 pending

Hello Salvatore,

Salvatore Bonaccorso [2023-05-09 22:30 +0200]:
> The following vulnerabilities were published for libssh.
>
> CVE-2023-1667[0]:
> | Potential NULL dereference during rekeying with algorithm guessing
>
> CVE-2023-2283[1]:
> | Authorization bypass in pki_verify_data_signature
>
> If you fix the vulnerabilities please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

I uploaded the new upstream release to unstable, with urgency=high to hopefully
make it into the release in time. With upstream's extensive unit tests and
Debian's reverse dependency autopkgtesting etc. I have enough confidence in
that.

I also checked buster. It's not affected by CVE-2023-2283, that code does not
exist in the 0.8 branch at all. The code for CVE-2023-1667 does exist, but it
is wildly different. Upstream does not maintain the 0.8 branch any more, and
I'm afraid I will not have the time/skills to analyze, understand, and backport
the patches myself, at least not to an extent where I'd have faith in them.

I'll attempt to backport the fixes for stable now.
https://git.libssh.org/projects/libssh.git/log/?h=stable-0.9 has quite some
changes before and beyond the actual security fix: some memory leak fixes,
moving some code around, indentation fixes, more unit tests. Personally I'd
rather trust upstream's release validation and update to 0.9.7 wholesale than
trying to pick it apart, but how is the Debian security team stanza wrt.
upstream microreleases these days?

Thanks,

Martin

Message #26 received at 1035832@bugs.debian.org (full text, mbox, reply):

From: Martin Pitt <mpitt@debian.org>

To: 1035832@bugs.debian.org

Cc: Salvatore Bonaccorso <carnil@debian.org>, security@debian.org

Subject: Re: Bug#1035832: libssh: CVE-2023-1667 CVE-2023-2283 -- stable (bullseye) update prepared

Date: Wed, 10 May 2023 09:33:25 +0200

Hello security team,

Martin Pitt [2023-05-10  8:19 +0200]:
> I'll attempt to backport the fixes for stable now.
> https://git.libssh.org/projects/libssh.git/log/?h=stable-0.9 has quite some
> changes before and beyond the actual security fix: some memory leak fixes,
> moving some code around, indentation fixes, more unit tests. Personally I'd
> rather trust upstream's release validation and update to 0.9.7 wholesale than
> trying to pick it apart, but how is the Debian security team stanza wrt.
> upstream microreleases these days?

I prepared a security update for the two CVEs, plus four "reformat code"
cherry-picks which changed the actual security fix from "hairy and risky" to
"only causes minor and obvious conflicts".

  https://salsa.debian.org/debian/libssh/-/commit/5aa68cee3d2e8a50402ef77623ff8ceac9eb183c
  https://salsa.debian.org/debian/libssh/-/commit/baa5cda9287580b16d3ecd9ecfc7fef82f2e12c2

They were taken from
https://git.libssh.org/projects/libssh.git/log/?h=stable-0.9 as "95% clean"
cherry-picks, which I found the best compromise wrt. minimizing risk. See the
Debian commit messages for details. I built the package in a clean bullseye
container, unit tests and autopkgtest pass.

The commit messages are more wordy than appropriate for the changelog. I'd use
a similar format as for unstable [1], e.g.

-------------- ✂️ ------------------
   * Fix authenticated remote DoS through potential NULL dereference
     during rekeying with algorithm guessing (CVE-2023-1667)
     https://www.libssh.org/security/advisories/CVE-2023-1667.txt
   * Fix client authentication bypass in pki_verify_data_signature()
     in low-memory conditions with OpenSSL backend; gcrypt backend is
     not affected (CVE-2023-2283, Closes: #1035832)
     https://www.libssh.org/security/advisories/CVE-2023-2283.txt
-------------- ✂️ ------------------

I'm happy to upload to the queue if/once you give me the signal, or massage the
patches/changelog according to your liking.

Thanks,

Martin

[1] https://git.libssh.org/projects/libssh.git/log/?h=stable-0.9

Send a report that this bug log contains spam.