CVE-2018-10933: Critical severity libssh libssh vulnerability
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libsshto a version that resolves this vulnerability.Fixed in 0.8.4-1Fixed in 0.7.3-2+deb9u1 - Upgrade
Upgrade
debian/libsshto a version that resolves this vulnerability.Fixed in 0.9.8-0+deb11u1Fixed in 0.9.8-0+deb11u2Fixed in 0.10.6-0+deb12u2Fixed in 0.10.6-0+deb12u1Fixed in 0.11.2-1+deb13u1Fixed in 0.11.3-1 - Upgrade
Upgrade
alpine/libsshto a version that resolves this vulnerability.Fixed in 0.7.6-r0 - Upgrade
Upgrade
libsshto a version that resolves this vulnerability.Fixed in 0.7.6 - Upgrade
Upgrade
libsshto a version that resolves this vulnerability.Fixed in 0.8.4
Event History
Frequently Asked Questions
What is CVE-2018-10933?
CVE-2018-10933 is a vulnerability found in libssh's server-side state machine before versions 0.7.6 and 0.8.4.
How does CVE-2018-10933 work?
CVE-2018-10933 allows a malicious client to create channels without authentication, leading to unauthorized access.
What is the severity of CVE-2018-10933?
The severity of CVE-2018-10933 is critical with a CVSS score of 9.1.
Which software versions are affected by CVE-2018-10933?
Versions 0.6.0 to 0.7.6 and 0.8.0 to 0.8.4 of libssh are affected by CVE-2018-10933.
How can I fix CVE-2018-10933?
To fix CVE-2018-10933, update libssh to version 0.7.6 or 0.8.4 or later.