RHSA-2024:0538MediumCVSS 5.9

Red Hat Security Advisory: libssh security update

Published
January 29, 2024
Last Modified
September 2, 2026

🔗 CVE IDs covered (3)

CVE-2023-48795 →CVE-2023-1667 →CVE-2023-2283 →

📋 Description

CVE-2023-1667 — libssh: NULL pointer dereference during rekeying with algorithm guessing CVE-2023-2283 — libssh: authorization bypass in pki_verify_data_signature CVE-2023-48795 — ssh: Prefix truncation attack on Binary Packet Protocol (BPP)

🎯 Affected products34

  • Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libssh-0:0.9.6-4.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libssh-0:0.9.6-4.el8_6.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libssh-0:0.9.6-4.el8_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libssh-0:0.9.6-4.el8_6.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libssh-0:0.9.6-4.el8_6.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libssh-0:0.9.6-4.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libssh-config-0:0.9.6-4.el8_6.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libssh-debuginfo-0:0.9.6-4.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libssh-debuginfo-0:0.9.6-4.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libssh-debuginfo-0:0.9.6-4.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libssh-debuginfo-0:0.9.6-4.el8_6.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libssh-debuginfo-0:0.9.6-4.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libssh-debuginfo-0:0.9.6-4.el8_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libssh-debuginfo-0:0.9.6-4.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libssh-debuginfo-0:0.9.6-4.el8_6.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libssh-debuginfo-0:0.9.6-4.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libssh-debuginfo-0:0.9.6-4.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libssh-debugsource-0:0.9.6-4.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libssh-debugsource-0:0.9.6-4.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libssh-debugsource-0:0.9.6-4.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libssh-debugsource-0:0.9.6-4.el8_6.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libssh-debugsource-0:0.9.6-4.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libssh-debugsource-0:0.9.6-4.el8_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libssh-debugsource-0:0.9.6-4.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libssh-debugsource-0:0.9.6-4.el8_6.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libssh-debugsource-0:0.9.6-4.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • libssh-debugsource-0:0.9.6-4.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • libssh-devel-0:0.9.6-4.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)
  • +4 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing these updated packages, all running applications using libssh must be restarted for this update to take effect. Workaround: Update to the last version and check that client and server provide kex pseudo-algorithms indicating usage of the updated version of the protocol which is protected from the attack. If "[email protected]" is provided by clients and "[email protected]" is in the server's reply, no other steps are necessary. Disabling ciphers if necessary: If "[email protected]" is not provided by clients or "[email protected]" is absent in the server's reply, you can disable the following ciphers and HMACs as a workaround on RHEL-8 and RHEL-9: 1. [email protected] 2. [email protected] 3. [email protected] 4. [email protected] 5. [email protected] To do that through crypto-policies, one can apply a subpolicy with the following content: ``` cipher@SSH = -CHACHA20-POLY1305 ssh_etm = 0 ``` e.g., by putting these lines into `/etc/crypto-policies/policies/modules/CVE-2023-48795.pmod`, applying the resulting subpolicy with `update-crypto-policies --set $(update-crypto-policies --show):CVE-2023-48795` and restarting openssh server. One can verify that the changes are in effect by ensuring the ciphers listed above are missing from both `/etc/crypto-policies/back-ends/openssh.config` and `/etc/crypto-policies/back-ends/opensshserver.config`. For more details on using crypto-policies, please refer to https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening Note that this procedure does limit the interoperability of the host and is only suggested as a temporary mitigation until the issue is fully resolved with an update. For RHEL-7: We can recommend to use strict MACs and Ciphers on RHEL7 in both files /etc/ssh/ssh_config and /etc/ssh/sshd_config. Below strict set of Ciphers and MACs can be used as mitigation for RHEL 7. ``` Ciphers aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected] MACs [email protected],[email protected],hmac-sha2-256,hmac-sha2-512 ``` - For Openshift Container Platform 4: Please refer the KCS[1] document for verifying the fix in RHCOS. [1] https://access.redhat.com/solutions/7071748

🔗 References (6)