CVE-2021-3634 — Out-of-bounds Write in Libssh

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	debian_linux	—	—
debian	libssh	< libssh 0.9.6-1 (bookworm)	libssh 0.9.6-1 (bookworm)
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
libssh	libssh	—	—
libssh	libssh	>= 0 < 0.9.5-1+deb11u1	0.9.5-1+deb11u1
libssh	libssh	>= 0 < 0.9.6-1	0.9.6-1
libssh	libssh	>= 0 < 0.9.6-1	0.9.6-1
libssh	libssh	>= 0 < 0.9.6-1	0.9.6-1
libssh	libssh	>= 0.9.1 < 0.9.6	0.9.6
msrc	cbl2_libssh_on_cbl_mariner_2.0	—	—
oracle	mysql_workbench	<= 8.0.27	—
redhat	enterprise_linux	—	—
redhat	virtualization	—	—

Oracle

Oracle Oracle MySQL Risk Matrix: Workbench: libssh — CVE-2021-3634

vendor_oracle·2022-01-15·CVSS 6.5

CVE-2021-3634 [MEDIUM] Oracle Oracle MySQL Risk Matrix: Workbench: libssh — CVE-2021-3634 Oracle Oracle MySQL Risk Matrix: Workbench: libssh vulnerability CVE: CVE-2021-3634 CVSS: 6.5 Protocol: MySQL Workbench Remote exploit: No Affected versions: Network Advisory: cpujan2022 (JAN 2022)

Red Hat

libssh: possible heap-based buffer overflow when rekeying

vendor_redhat·2021-08-26·CVSS 6.5

CVE-2021-3634 [MEDIUM] CWE-787 libssh: possible heap-based buffer overflow when rekeying libssh: possible heap-based buffer overflow when rekeying A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other session_id. Initially, both of them are the same, but after key re-exchange, previous session_id is kept and used as an input to new secret_hash. Historically, both of these buffers had shared length variable, which worked as long as these buffers were same. But the key re-exchange operation can also change the key exchange method, which can be based on hash of different size, eventually creating "secret_hash" of different size than the session_id has. This becomes an issue when the session_id memory is zeroed or when it is used again durin

Ubuntu

libssh vulnerability

vendor_ubuntu·2021-08-26

CVE-2021-3634 libssh vulnerability Title: libssh vulnerability Summary: libssh could be made to crash or run programs if it received specially crafted network traffic. It was discovered that libssh incorrectly handled rekeying. A remote attacker could use this issue to cause libssh to crash, resulting in a denial of service, or possibly execute arbitrary code. Instructions: In general, a standard system update will make all the necessary changes.

Microsoft

A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other sessi

vendor_msrc·2021-08-10·CVSS 6.5

CVE-2021-3634 [MEDIUM] CWE-787 A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other sessi A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other session_id. Initially, both of them are the same, but after key re-exchange, previous session_id is kept and used as an input to new secret_hash. Historically, both of these buffers had shared length variable, which worked as long as these buffers were same. But the key re-exchange operation can also change the key exchange method, which can be based on hash of different size, eventually creating "secret_hash" of different size than the session_id has. This becomes an issue when the session_id memory is zeroed or when it is used again during second key re-exchange. FAQ: Is Azure Linux the only Mic

Debian

CVE-2021-3634: libssh - A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol kee...

vendor_debian·2021·CVSS 6.5

CVE-2021-3634 [MEDIUM] CVE-2021-3634: libssh - A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol kee... A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other session_id. Initially, both of them are the same, but after key re-exchange, previous session_id is kept and used as an input to new secret_hash. Historically, both of these buffers had shared length variable, which worked as long as these buffers were same. But the key re-exchange operation can also change the key exchange method, which can be based on hash of different size, eventually creating "secret_hash" of different size than the session_id has. This becomes an issue when the session_id memory is zeroed or when it is used again during second key re-exchange. Scope: local bookworm: resolved (

GHSA

GHSA-4wwm-f449-qwpq: A flaw has been found in libssh in versions prior to 0

ghsa_unreviewed·2022-05-24

CVE-2021-3634 [MEDIUM] CWE-119 GHSA-4wwm-f449-qwpq: A flaw has been found in libssh in versions prior to 0 A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other session_id. Initially, both of them are the same, but after key re-exchange, previous session_id is kept and used as an input to new secret_hash. Historically, both of these buffers had shared length variable, which worked as long as these buffers were same. But the key re-exchange operation can also change the key exchange method, which can be based on hash of different size, eventually creating "secret_hash" of different size than the session_id has. This becomes an issue when the session_id memory is zeroed or when it is used again during second key re-exchange.

OSV

CVE-2021-3634: A flaw has been found in libssh in versions prior to 0

osv·2021-08-31·CVSS 6.5

CVE-2021-3634 [MEDIUM] CVE-2021-3634: A flaw has been found in libssh in versions prior to 0 A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other session_id. Initially, both of them are the same, but after key re-exchange, previous session_id is kept and used as an input to new secret_hash. Historically, both of these buffers had shared length variable, which worked as long as these buffers were same. But the key re-exchange operation can also change the key exchange method, which can be based on hash of different size, eventually creating "secret_hash" of different size than the session_id has. This becomes an issue when the session_id memory is zeroed or when it is used again during second key re-exchange.

CVE-2021-3634: A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them…

Affected

CVSS provenance