REDHAT-BUG-2498168: Low severity libssh libssh vulnerability
A flaw was found in libssh in the server-side GSSAPI Curve25519 key exchange path in src/kex-gss.c. In sshservergsskexprocessinit(), a client-controlled SSH string is unpacked into clientpubkey and then copied with memcpy(..., CURVE25519PUBKEYSIZE) without validating sshstringlen(clientpubkey). A remote unauthenticated client can send a short public key in SSHMSGKEXGSSINIT and trigger an out-of-bounds heap read during handshake processing, disclosing small amounts of adjacent server memory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2498168?
The severity of REDHAT-BUG-2498168 is classified as low.
What is the nature of the flaw in REDHAT-BUG-2498168?
REDHAT-BUG-2498168 is a flaw in libssh related to an unvalidated client-controlled SSH string in the key exchange process.
How do I fix REDHAT-BUG-2498168?
To fix REDHAT-BUG-2498168, update libssh to the latest version where the issue is addressed.
What components are affected by REDHAT-BUG-2498168?
The components affected by REDHAT-BUG-2498168 include the libssh software.
Is REDHAT-BUG-2498168 a serious vulnerability?
While REDHAT-BUG-2498168 has a low severity rating, it is still important to address it to maintain security.