REDHAT-BUG-2369367: Double Free
A Double Free vulnerability exists in libssh’s key export mechanism when built against OpenSSL 3.0 or later. The flaw lies in the pkikeytoblob() function, where a memory structure (params) is deallocated during error handling but not properly nullified. If a subsequent operation encounters an error, the same structure may be freed again, leading to undefined behavior and potential process crashes. Although exploitation requires authenticated access and specific memory failure conditions, the flaw could be leveraged to destabilize applications using libssh for exporting SSH key material.
Affected versions : libssh >= 0.10.0, built with OpenSSL >= 3.0
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2369367?
The severity of REDHAT-BUG-2369367 is critical due to its potential for remote code execution.
How do I fix REDHAT-BUG-2369367?
To fix REDHAT-BUG-2369367, update libssh to the latest version that addresses this vulnerability.
Which versions are affected by REDHAT-BUG-2369367?
REDHAT-BUG-2369367 affects libssh versions from 0.10.0 and OpenSSL versions from 3.0 onwards.
What are the consequences of not addressing REDHAT-BUG-2369367?
Not addressing REDHAT-BUG-2369367 could lead to unauthorized access and manipulation of affected systems.
Is REDHAT-BUG-2369367 a widespread vulnerability?
Yes, REDHAT-BUG-2369367 is considered widespread as it affects widely used cryptographic libraries.