FEDORA-EPEL-2025-c1a3189d11 — security update for libssh2

stable

libssh2-1.11.1-1.el9

FEDORA-EPEL-2025-c1a3189d11 created by pghmcfc a year ago for Fedora EPEL 9

This update, to the current upstream libssh2 release, addresses a couple of security issues:

CVE-2023-6918 (missing checks for return values for digests)
CVE-2023-48795 (prefix truncation attack on Binary Packet Protocol (BPP) - "Terrapin")

It also removes support for a number of legacy algorithms that were disabled by default or removed from OpenSSH in the 2015-2018 time period. See the RELEASE_NOTES file for full details.

In addition, there are a large number of bug fixes and enhancements, which again are described in the RELEASE_NOTES file.

This update has been submitted for testing by pghmcfc.

a year ago

This update's test gating status has been changed to 'ignored'.

a year ago

This update has been pushed to testing.

a year ago

This update has been submitted for stable by bodhi.

12 months ago

This update has been pushed to stable.

12 months ago

Please log in to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-1

Stable by Karma

Stable by Time

7 days

Dates

submitted

a year ago

in testing

a year ago

in stable

12 months ago

approved

12 months ago

Builds

libssh2-1.11.1-1.el9

BZ#2254210 CVE-2023-48795 ssh: Prefix truncation attack on Binary Packet Protocol (BPP)

BZ#2254997 CVE-2023-6918 libssh: Missing checks for return values for digests

BZ#2255046 CVE-2023-48795 libssh2: ssh: Prefix truncation attack on Binary Packet Protocol (BPP) [epel-all]

BZ#2255158 TRIAGE CVE-2023-6918 libssh2: libssh: Missing checks for return values for digests [epel-all]

libssh2-1.11.1-1.el9

Automated Test Results

ignored