Libssh: libssh: denial of service via improper configuration file handling
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 6 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 7 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 8 | affected | — | ||||||
| Red Hat | Red Hat Hardened Images | unaffected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — |
Configuration 1 [-]
|
No data.
| Vendor | Product | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Libssh | Libssh |
|
Vendor Workaround
Ensure the client and server are using only regular files as configuration.
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4844-1 | libssh security update |
Debian DSA |
DSA-6410-1 | libssh security update |
Ubuntu USN |
USN-8051-2 | libssh vulnerabilities |
Ubuntu USN |
USN-8051-1 | libssh vulnerabilities |
No CVSS v4.0
No CVSS v3.1
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.167% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel Els
|
|
| CPEs | cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 |
cpe:/a:redhat:enterprise_linux:8 cpe:/o:redhat:rhel_els:6 cpe:/o:redhat:rhel_els:7 |
| Vendors & Products |
Redhat rhel Els
|
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos |
|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/o:redhat:enterprise_linux:10.2 | |
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat hummingbird
|
|
| CPEs | cpe:/a:redhat:hummingbird:1 | |
| Vendors & Products |
Redhat hummingbird
|
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* |
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | No description is available for this CVE. | A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations. |
| Title | libssh: libssh: Denial of Service via improper configuration file handling | Libssh: libssh: denial of service via improper configuration file handling |
| First Time appeared |
Redhat
Redhat enterprise Linux Redhat openshift |
|
| CPEs | cpe:/a:redhat:openshift:4 cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9 |
|
| Vendors & Products |
Redhat
Redhat enterprise Linux Redhat openshift |
|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Libssh
Libssh libssh |
|
| Vendors & Products |
Libssh
Libssh libssh |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | No description is available for this CVE. | |
| Title | libssh: libssh: Denial of Service via improper configuration file handling | |
| Weaknesses | CWE-73 | |
| References |
| |
| Metrics |
threat_severity
|
cvssV3_0
|