OESA-2024-1123

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1123

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2024-1123.json

JSON Data

https://api.test.osv.dev/v1/vulns/OESA-2024-1123

Upstream

CVE-2023-6004

Published

2024-02-02T11:06:53Z

Modified

2025-08-12T05:24:37.307875Z

Summary

libssh security update

Details

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).

Security Fix(es):

A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.(CVE-2023-6004)

Database specific

{
    "severity": "Medium"
}

References

Affected packages

openEuler:22.03-LTS-SP2 / libssh

Package

Name: libssh
Purl: pkg:rpm/openEuler/libssh&distro=openEuler-22.03-LTS-SP2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.9.6-8.oe2203sp2

Ecosystem specific

{
    "aarch64": [
        "libssh-debugsource-0.9.6-8.oe2203sp2.aarch64.rpm",
        "libssh-devel-0.9.6-8.oe2203sp2.aarch64.rpm",
        "libssh-debuginfo-0.9.6-8.oe2203sp2.aarch64.rpm",
        "libssh-0.9.6-8.oe2203sp2.aarch64.rpm"
    ],
    "src": [
        "libssh-0.9.6-8.oe2203sp2.src.rpm"
    ],
    "noarch": [
        "libssh-help-0.9.6-8.oe2203sp2.noarch.rpm"
    ],
    "x86_64": [
        "libssh-debugsource-0.9.6-8.oe2203sp2.x86_64.rpm",
        "libssh-0.9.6-8.oe2203sp2.x86_64.rpm",
        "libssh-devel-0.9.6-8.oe2203sp2.x86_64.rpm",
        "libssh-debuginfo-0.9.6-8.oe2203sp2.x86_64.rpm"
    ]
}