SUSE-RU-2023:4192-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2023/suse-ru-20234192-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-RU-2023:4192-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-RU-2023:4192-1

Related

CVE-2019-17498

Published

2023-10-25T08:35:13Z

Modified

2023-10-25T08:35:13Z

Summary

Recommended update for libssh2_org

Details

This update for libssh2_org fixes the following issues:

Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040]

Update to 1.11.0:

Enhancements and bugfixes
- Adds support for encrypt-then-mac (ETM) MACs
- Adds support for AES-GCM crypto protocols
- Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys
- Adds support for RSA certificate authentication
- Adds FIDO support with *_sk() functions
- Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends
- Adds Agent Forwarding and libssh2agentsign()
- Adds support for Channel Signal message libssh2channelsignal_ex()
- Adds support to get the user auth banner message libssh2userauthbanner()
- Adds LIBSSH2NO{MD5, HMACRIPEMD, DSA, RSA, RSASHA1, ECDSA, ED25519, AESCBC, AESCTR, BLOWFISH, RC4, CAST, 3DES} options
- Adds direct stream UNIX sockets with libssh2channeldirectstreamlocalex()
- Adds wolfSSL support to CMake file
- Adds mbedTLS 3.x support
- Adds LibreSSL 3.5 support
- Adds support for CMake 'unity' builds
- Adds CMake support for building shared and static libs in a single pass
- Adds symbol hiding support to CMake
- Adds support for libssh2.rc for all build tools
- Adds .zip, .tar.xz and .tar.bz2 release tarballs
- Enables ed25519 key support for LibreSSL 3.7.0 or higher
- Improves OpenSSL 1.1 and 3 compatibility
- Now requires OpenSSL 1.0.2 or newer
- Now requires CMake 3.1 or newer
- SFTP: Adds libssh2sftpopenexr() and libssh2sftpopen_r() extended APIs
- SFTP: No longer has a packet limit when reading a directory
- SFTP: now parses attribute extensions if they exist
- SFTP: no longer will busy loop if SFTP fails to initialize
- SFTP: now clear various errors as expected
- SFTP: no longer skips files if the line buffer is too small
- SCP: add option to not quote paths
- SCP: Enables 64-bit offset support unconditionally
- Now skips leading \r and \n characters in banner_receive()
- Enables secure memory zeroing with all build tools on all platforms
- No longer logs SSHMSGREQUEST_FAILURE packets from keepalive
- Speed up base64 encoding by 7x
- Assert if there is an attempt to write a value that is too large
- WinCNG: fix memory leak in libssh2dh_secret()
- Added protection against possible null pointer dereferences
- Agent now handles overly large comment lengths
- Now ensure KEX replies don't include extra bytes
- Fixed possible buffer overflow when receiving SSHMSGUSERAUTH_BANNER
- Fixed possible buffer overflow in keyboard interactive code path
- Fixed overlapping memcpy()
- Fixed Windows UWP builds
- Fixed DLL import name
- Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows
- Support for building with gcc versions older than 8
- Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files
- Restores ANSI C89 compliance
- Enabled new compiler warnings and fixed/silenced them
- Improved error messages
- Now uses CIFuzz
- Numerous minor code improvements
- Improvements to CI builds
- Improvements to unit tests
- Improvements to doc files
- Improvements to example files
- Removed 'old gex' build option
- Removed no-encryption/no-mac builds
- Removed support for NetWare and Watcom wmake build files
- Bump to version 1.10.0
Enhancements and bugfixes:
- support ECDSA certificate authentication
- fix detailed libssh2error being overwritten by generic errors
- unified error handling
- fix libssh2random() silently discarding errors
- don't error if using keys without RSA
- avoid OpenSSL latent error in FIPS mode
- fix EVP_Cipher interface change in openssl 3
- fix potential overwrite of buffer when reading stdout of command
- use stringbuf in ecdhsha2_nistp() to avoid attempting to parse malformed data
- correct a typo which may lead to stack overflow
- fix random big number generation to match openssl
- added key exchange group16-sha512 and group18-sha512.
- add support for an OSS Fuzzer fuzzing target
- adds support for ECDSA for both key exchange and host key algorithms
- clean up curve25519 code
- update the min, preferred and max DH group values based on RFC 8270.
- changed type of LIBSSH2FX* constants to unsigned long
- added diffie-hellman-group14-sha256 kex
- fix for use of uninitialized aesctrcipher.keylen when using HAVEOPAQUE_STRUCTS, regression
- fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x.
- fixes crash with delayed compression option using Bitvise server.
- adds support for PKIX key reading
- use new API to parse data in packetx11open() for better bounds checking.
- double the static buffer size when reading and writing known hosts
- improved bounds checking in packetqueuelistener
- improve message parsing (CVE-2019-17498)
- improve bounds checking in kexagreemethods()
- adding SSH agent forwarding.
- fix agent forwarding message, updated example.
- added integration test code and cmake target. Added example to cmake list.
- don't call libssh2_crypto_exit() until _libssh2_initialized count is down to zero.
- add an EWOULDBLOCK check for better portability
- fix off by one error when loading public keys with no id
- fix use-after-free crash on reinitialization of openssl backend
- preserve error info from agentlistidentities()
- make sure the error code is set in libssh2channel_open()
- fixed misspellings
- fix potential typecast error for _libssh2_ecdsa_key_get_curve_type
- rename libssh2ecdsakeygetcurvetype to libssh2ecdsagetcurve_type

References

Affected packages

SUSE:Linux Enterprise Micro 5.3 / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Linux%20Enterprise%20Micro%205.3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Linux Enterprise Micro 5.4 / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Linux%20Enterprise%20Micro%205.4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Linux Enterprise Micro 5.5 / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Linux%20Enterprise%20Micro%205.5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Linux Enterprise Module for Basesystem 15 SP4 / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1",
            "libssh2-devel": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Linux Enterprise Module for Basesystem 15 SP5 / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1",
            "libssh2-devel": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1",
            "libssh2-devel": "1.11.0-150000.4.19.1",
            "libssh2-1-32bit": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1",
            "libssh2-devel": "1.11.0-150000.4.19.1",
            "libssh2-1-32bit": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1",
            "libssh2-devel": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1",
            "libssh2-devel": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Linux Enterprise Server 15 SP1-LTSS / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1",
            "libssh2-devel": "1.11.0-150000.4.19.1",
            "libssh2-1-32bit": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Linux Enterprise Server 15 SP2-LTSS / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1",
            "libssh2-devel": "1.11.0-150000.4.19.1",
            "libssh2-1-32bit": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Linux Enterprise Server 15 SP3-LTSS / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1",
            "libssh2-devel": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 15 SP1 / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1",
            "libssh2-devel": "1.11.0-150000.4.19.1",
            "libssh2-1-32bit": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 15 SP2 / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1",
            "libssh2-devel": "1.11.0-150000.4.19.1",
            "libssh2-1-32bit": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 15 SP3 / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1",
            "libssh2-devel": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Manager Proxy 4.2 / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Manager%20Proxy%204.2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1",
            "libssh2-devel": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Manager Server 4.2 / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Manager%20Server%204.2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1",
            "libssh2-devel": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Linux Enterprise Micro 5.1 / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Linux%20Enterprise%20Micro%205.1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Linux Enterprise Micro 5.2 / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Linux%20Enterprise%20Micro%205.2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1"
        }
    ]
}

SUSE:Enterprise Storage 7.1 / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=SUSE%20Enterprise%20Storage%207.1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1",
            "libssh2-devel": "1.11.0-150000.4.19.1"
        }
    ]
}

openSUSE:Leap Micro 5.3 / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=openSUSE%20Leap%20Micro%205.3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1"
        }
    ]
}

openSUSE:Leap Micro 5.4 / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=openSUSE%20Leap%20Micro%205.4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1"
        }
    ]
}

openSUSE:Leap 15.4 / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=openSUSE%20Leap%2015.4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1",
            "libssh2-devel": "1.11.0-150000.4.19.1",
            "libssh2-1-32bit": "1.11.0-150000.4.19.1"
        }
    ]
}

openSUSE:Leap 15.5 / libssh2_org

Package

Name: libssh2_org
Purl: purl:rpm/suse/libssh2_org&distro=openSUSE%20Leap%2015.5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-150000.4.19.1

Ecosystem specific

{
    "binaries": [
        {
            "libssh2-1": "1.11.0-150000.4.19.1",
            "libssh2-devel": "1.11.0-150000.4.19.1",
            "libssh2-1-32bit": "1.11.0-150000.4.19.1"
        }
    ]
}