Moderate: libssh security, bug fix, and enhancement update

Synopsis

Moderate: libssh security, bug fix, and enhancement update

Type/Severity

Security Advisory: Moderate

Topic

An update for libssh is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.

The following packages have been upgraded to a later upstream version: libssh (0.9.4). (BZ#1804797)

Security Fix(es):

• libssh: denial of service when handling AES-CTR (or DES) ciphers (CVE-2020-1730)
  
• libssh: unsanitized location in scp could lead to unwanted command execution (CVE-2019-14889)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing these updated packages, all running applications using libssh must be restarted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

• BZ - 1733914 - No $HOME/.config dir created if connect libvirtd with libssh
• BZ - 1772523 - CVE-2019-14889 libssh: unsanitized location in scp could lead to unwanted command execution
• BZ - 1801998 - CVE-2020-1730 libssh: denial of service when handling AES-CTR (or DES) ciphers
• BZ - 1804797 - Rebase libssh to the latest upstream version
• BZ - 1821339 - libssh based server automatically tries to load OpenSSH server configuration
• BZ - 1849071 - libssh ssh_channel_read() randomly returns error

CVEs

• CVE-2019-14889
• CVE-2020-1730

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/