RHSA-2023:3839MediumCVSS 4.8

Red Hat Security Advisory: libssh security update

Published
June 27, 2023
Last Modified
November 7, 2026

🔗 CVE IDs covered (2)

CVE-2023-1667 →CVE-2023-2283 →

📋 Description

CVE-2023-1667 — libssh: NULL pointer dereference during rekeying with algorithm guessing CVE-2023-2283 — libssh: authorization bypass in pki_verify_data_signature

🎯 Affected products34

  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux BaseOS (v. 8)
  • libssh-0:0.9.6-10.el8_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • libssh-0:0.9.6-10.el8_8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • libssh-0:0.9.6-10.el8_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • libssh-0:0.9.6-10.el8_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • libssh-0:0.9.6-10.el8_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • libssh-0:0.9.6-10.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • libssh-config-0:0.9.6-10.el8_8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • libssh-debuginfo-0:0.9.6-10.el8_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libssh-debuginfo-0:0.9.6-10.el8_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • libssh-debuginfo-0:0.9.6-10.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libssh-debuginfo-0:0.9.6-10.el8_8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • libssh-debuginfo-0:0.9.6-10.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libssh-debuginfo-0:0.9.6-10.el8_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • libssh-debuginfo-0:0.9.6-10.el8_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libssh-debuginfo-0:0.9.6-10.el8_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • libssh-debuginfo-0:0.9.6-10.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libssh-debuginfo-0:0.9.6-10.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • libssh-debugsource-0:0.9.6-10.el8_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libssh-debugsource-0:0.9.6-10.el8_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • libssh-debugsource-0:0.9.6-10.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libssh-debugsource-0:0.9.6-10.el8_8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • libssh-debugsource-0:0.9.6-10.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libssh-debugsource-0:0.9.6-10.el8_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • libssh-debugsource-0:0.9.6-10.el8_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libssh-debugsource-0:0.9.6-10.el8_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • libssh-debugsource-0:0.9.6-10.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libssh-debugsource-0:0.9.6-10.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • libssh-devel-0:0.9.6-10.el8_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +4 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing these updated packages, all running applications using libssh must be restarted for this update to take effect.

🔗 References (5)