SUSE-SU-2024:0140-1: Security update for libssh

Q: Which systems and packages are covered by this update?

The update applies to libssh packages on SUSE openSUSE Leap 15.4, including libssh4, libssh-config, libssh-devel, debugsource, and debuginfo packages. Listed architectures are aarch64, aarch64_ilp32, ppc64le, s390x, x86_64, and i586.

Q: What conditions are needed for the command-injection issue?

The command-injection fix concerns use of ProxyCommand. Systems using libssh functionality that processes ProxyCommand are the relevant exposure area described by the advisory.

Q: Are there security impacts beyond command injection?

Yes. The update also fixes a potential strict-KEX downgrade attack, missing return-value checks in MD functions, a NULL dereference during rekeying with algorithm guessing, and a possible signature-verification authorization bypass under low-memory conditions.

Published Jan 18, 2024

Updated

This update for libssh fixes the following issues: Security fixes: CVE-2023-6004: Fixed command injection using proxycommand (bsc#1218209) CVE-2023-48795: Fixed potential downgrade attack using strict kex (bsc#1218126) CVE-2023-6918: Fixed missing checks for return values of MD functions (bsc#1218186) CVE-2023-1667: Fixed NULL dereference during rekeying with algorithm guessing (bsc#1211188) CVE-2023-2283: Fixed possible authorization bypass in pkiverifydatasignature under low-memory conditions (bsc#1211190) Other fixes: Update to version 0.9.8

Allow @ in usernames when parsing from URI composes

Update to version 0.9.7

Fix several memory leaks in GSSAPI handling code

Affected Software

141 affected componentsFixes available

All of the following

SUSE openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-devel<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

All of the following

SUSE openSUSE Leap 15.4 (x86_64)

Any of the following

suse/libssh4<32bit-0.9.8-150400.3.3.1

32bit-0.9.8-150400.3.3.1

suse/libssh4<32bit-debuginfo-0.9.8-150400.3.3.1

32bit-debuginfo-0.9.8-150400.3.3.1

All of the following

SUSE openSUSE Leap 15.4 (aarch64_ilp32)

Any of the following

suse/libssh4<64bit-0.9.8-150400.3.3.1

64bit-0.9.8-150400.3.3.1

suse/libssh4<64bit-debuginfo-0.9.8-150400.3.3.1

64bit-debuginfo-0.9.8-150400.3.3.1

All of the following

SUSE openSUSE Leap Micro 5.3 (aarch64 x86_64)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

All of the following

SUSE openSUSE Leap Micro 5.4 (aarch64 s390x x86_64)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

All of the following

SUSE openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-devel<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

Any of the following

suse/libssh4<32bit-0.9.8-150400.3.3.1

32bit-0.9.8-150400.3.3.1

suse/libssh4<32bit-debuginfo-0.9.8-150400.3.3.1

32bit-debuginfo-0.9.8-150400.3.3.1

All of the following

SUSE SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

All of the following

SUSE SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

All of the following

SUSE SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

All of the following

SUSE SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

All of the following

SUSE SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

All of the following

SUSE Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-devel<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

All of the following

SUSE Basesystem Module 15-SP5 (x86_64)

Any of the following

suse/libssh4<32bit-0.9.8-150400.3.3.1

32bit-0.9.8-150400.3.3.1

suse/libssh4<32bit-debuginfo-0.9.8-150400.3.3.1

32bit-debuginfo-0.9.8-150400.3.3.1

All of the following

SUSE SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-devel<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

All of the following

SUSE SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (x86_64)

Any of the following

suse/libssh4<32bit-0.9.8-150400.3.3.1

32bit-0.9.8-150400.3.3.1

suse/libssh4<32bit-debuginfo-0.9.8-150400.3.3.1

32bit-debuginfo-0.9.8-150400.3.3.1

All of the following

SUSE SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-devel<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

All of the following

SUSE SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (x86_64)

Any of the following

suse/libssh4<32bit-0.9.8-150400.3.3.1

32bit-0.9.8-150400.3.3.1

suse/libssh4<32bit-debuginfo-0.9.8-150400.3.3.1

32bit-debuginfo-0.9.8-150400.3.3.1

All of the following

SUSE SUSE Linux Enterprise Real Time 15 SP4 (x86_64)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<32bit-0.9.8-150400.3.3.1

32bit-0.9.8-150400.3.3.1

suse/libssh4<32bit-debuginfo-0.9.8-150400.3.3.1

32bit-debuginfo-0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-devel<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

All of the following

SUSE SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<32bit-0.9.8-150400.3.3.1

32bit-0.9.8-150400.3.3.1

suse/libssh4<32bit-debuginfo-0.9.8-150400.3.3.1

32bit-debuginfo-0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-devel<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

All of the following

SUSE SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-devel<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

All of the following

SUSE SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (x86_64)

Any of the following

suse/libssh4<32bit-0.9.8-150400.3.3.1

32bit-0.9.8-150400.3.3.1

suse/libssh4<32bit-debuginfo-0.9.8-150400.3.3.1

32bit-debuginfo-0.9.8-150400.3.3.1

All of the following

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-devel<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

All of the following

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP4 (x86_64)

Any of the following

suse/libssh4<32bit-0.9.8-150400.3.3.1

32bit-0.9.8-150400.3.3.1

suse/libssh4<32bit-debuginfo-0.9.8-150400.3.3.1

32bit-debuginfo-0.9.8-150400.3.3.1

All of the following

SUSE SUSE Manager Proxy 4.3 (x86_64)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<32bit-0.9.8-150400.3.3.1

32bit-0.9.8-150400.3.3.1

suse/libssh4<32bit-debuginfo-0.9.8-150400.3.3.1

32bit-debuginfo-0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-devel<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

All of the following

SUSE SUSE Manager Retail Branch Server 4.3 (x86_64)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<32bit-0.9.8-150400.3.3.1

32bit-0.9.8-150400.3.3.1

suse/libssh4<32bit-debuginfo-0.9.8-150400.3.3.1

32bit-debuginfo-0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-devel<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

All of the following

SUSE SUSE Manager Server 4.3 (ppc64le s390x x86_64)

Any of the following

suse/libssh-config<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-debugsource<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4-debuginfo<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh-devel<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

suse/libssh4<0.9.8-150400.3.3.1

0.9.8-150400.3.3.1

All of the following

SUSE SUSE Manager Server 4.3 (x86_64)

Any of the following

suse/libssh4<32bit-0.9.8-150400.3.3.1

32bit-0.9.8-150400.3.3.1

suse/libssh4<32bit-debuginfo-0.9.8-150400.3.3.1

32bit-debuginfo-0.9.8-150400.3.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/libssh-config to a version that resolves this vulnerability.
Fixed in 0.9.8-150400.3.3.1
Upgrade
Upgrade suse/libssh-debugsource to a version that resolves this vulnerability.
Fixed in 0.9.8-150400.3.3.1
Upgrade
Upgrade suse/libssh4-debuginfo to a version that resolves this vulnerability.
Fixed in 0.9.8-150400.3.3.1
Upgrade
Upgrade suse/libssh-devel to a version that resolves this vulnerability.
Fixed in 0.9.8-150400.3.3.1
Upgrade
Upgrade suse/libssh4 to a version that resolves this vulnerability.
Fixed in 0.9.8-150400.3.3.1
Upgrade
Upgrade suse/libssh4 to a version that resolves this vulnerability.
Fixed in 32bit-0.9.8-150400.3.3.1
Upgrade
Upgrade suse/libssh4 to a version that resolves this vulnerability.
Fixed in 32bit-debuginfo-0.9.8-150400.3.3.1
Upgrade
Upgrade suse/libssh4 to a version that resolves this vulnerability.
Fixed in 64bit-0.9.8-150400.3.3.1
Upgrade
Upgrade suse/libssh4 to a version that resolves this vulnerability.
Fixed in 64bit-debuginfo-0.9.8-150400.3.3.1
Upgrade
Upgrade libssh to a version that resolves this vulnerability.
Fixed in 0.9.7
Upgrade
Upgrade libssh to a version that resolves this vulnerability.
Fixed in 0.9.8
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-2024-140=1

Event History

Jan 18, 2024

Advisory Published

via SUSE·12:30 PM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which systems and packages are covered by this update?

The update applies to libssh packages on SUSE openSUSE Leap 15.4, including libssh4, libssh-config, libssh-devel, debugsource, and debuginfo packages. Listed architectures are aarch64, aarch64_ilp32, ppc64le, s390x, x86_64, and i586.

What conditions are needed for the command-injection issue?

The command-injection fix concerns use of ProxyCommand. Systems using libssh functionality that processes ProxyCommand are the relevant exposure area described by the advisory.

Are there security impacts beyond command injection?

Yes. The update also fixes a potential strict-KEX downgrade attack, missing return-value checks in MD functions, a NULL dereference during rekeying with algorithm guessing, and a possible signature-verification authorization bypass under low-memory conditions.

SUSE-SU-2024:0140-1: Security update for libssh

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems and packages are covered by this update?

What conditions are needed for the command-injection issue?

Are there security impacts beyond command injection?

Company

Resources

Contact

Frequently Asked Questions

Which systems and packages are covered by this update?

What conditions are needed for the command-injection issue?

Are there security impacts beyond command injection?