CVE-2023-2283: falha em libssh
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 1.1%
A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.
Produtos afetados
n/a · libsshReferências
http://packetstormsecurity.com/files/172861/libssh-0.9.6-0.10.4-pki_verify_data_signature-Authorization-Bypass.htmlhttps://access.redhat.com/security/cve/CVE-2023-2283https://bugzilla.redhat.com/show_bug.cgi?id=2189736http://seclists.org/fulldisclosure/2025/Feb/18https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27PD44ALQTZXX7K6JAM3BXBUHYA6DFFN/https://security.gentoo.org/glsa/202312-05https://security.netapp.com/advisory/ntap-20240201-0005/https://www.libssh.org/security/advisories/CVE-2023-2283.txt