Debian Libssh vulnerabilities

CVE-2023-48795 [MEDIUM] CVE-2023-48795: dropbear - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH bef... The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabl

CVE-2018-10933 [CRITICAL] CVE-2018-10933: libssh - A vulnerability was found in libssh's server-side state machine before versions ... A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access. Scope: local bookworm: resolved (fixed in 0.8.4-1) bullseye: resolved (fixed in 0.8.4-1) forky: resolved (fixed in 0.8.4-1) sid: resolved (fixed in 0.8.

CVE-2019-14889 [HIGH] CVE-2019-14889: libssh - A flaw was found with the libssh API function ssh_scp_new() in versions before 0... A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an

CVE-2025-5987 [HIGH] CVE-2025-5987: libssh - A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL libra... A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error return

CVE-2025-5318 [HIGH] CVE-2025-5318: libssh - A flaw was found in the libssh library in versions less than 0.11.2. An out-of-b... A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attac

CVE-2025-5372 [MEDIUM] CVE-2025-5372: libssh - A flaw was found in libssh versions built with OpenSSL versions older than 3.0, ... A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This result

CVE-2012-4562 [HIGH] CVE-2012-4562: libssh - Multiple integer overflows in libssh before 0.5.3 allow remote attackers to caus... Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (infinite loop or crash) and possibly execute arbitrary code via unspecified vectors, which triggers a buffer overflow, infinite loop, or possibly some other unspecified vulnerabilities. Scope: local bookworm: resolved (fixed in 0.5.3-1) bullseye: resolved (fixed in 0.

CVE-2026-0966 [MEDIUM] CVE-2026-0966: libssh - The API function `ssh_get_hexa()` is vulnerable, when 0-lenght input is provided... The API function `ssh_get_hexa()` is vulnerable, when 0-lenght input is provided to this function. This function is used internally in `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated), which is vulnerable to the same input (length is provided by the calling application). The function is also used internally in the gssapi code for logging the OIDs rece

CVE-2026-3731 [MEDIUM] CVE-2026-3731: libssh - A weakness has been identified in libssh up to 0.11.3. The impacted element is t... A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 i

CVE-2012-4560 [HIGH] CVE-2012-4560: libssh - Multiple buffer overflows in libssh before 0.5.3 allow remote attackers to cause... Multiple buffer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors. Scope: local bookworm: resolved (fixed in 0.5.3-1) bullseye: resolved (fixed in 0.5.3-1) forky: resolved (fixed in 0.5.3-1) sid: resolved (fixed in 0.5.3-1) trixie: resolved (fixed in 0.5.3-1)

CVE-2015-3146 [HIGH] CVE-2015-3146: libssh - The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_c... The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not properly validate state, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet. Scope: local bookworm: resolved (fixed in 0.6.3-4.2) bullseye: resolved (fixed in 0.6.3-4.2) forky: resolved (

CVE-2021-3634 [MEDIUM] CVE-2021-3634: libssh - A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol kee... A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other session_id. Initially, both of them are the same, but after key re-exchange, previous session_id is kept and used as an input to new secret_hash. Historically, both of these

CVE-2026-0964 [MEDIUM] CVE-2026-0964: libssh - A malicious SCP server can send unexpected paths that could make the client appl... A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue as in OpenSSH, tracked as CVE-2019-6111. Scope: local bookworm: open bu

CVE-2012-6063 [MEDIUM] CVE-2012-6063: libssh - Double free vulnerability in the sftp_mkdir function in sftp.c in libssh before ... Double free vulnerability in the sftp_mkdir function in sftp.c in libssh before 0.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors, a different vector than CVE-2012-4559. Scope: local bookworm: resolved (fixed in 0.5.3-1) bullseye: resolved (fixed in 0.5.3-1) forky: resolved (fixed in 0.5.3-1

CVE-2012-4559 [MEDIUM] CVE-2012-4559: libssh - Multiple double free vulnerabilities in the (1) agent_sign_data function in agen... Multiple double free vulnerabilities in the (1) agent_sign_data function in agent.c, (2) channel_request function in channels.c, (3) ssh_userauth_pubkey function in auth.c, (4) sftp_parse_attr_3 function in sftp.c, and (5) try_publickey_from_file function in keyfiles.c in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) and possibly exe

CVE-2025-5449 [MEDIUM] CVE-2025-5449: libssh - A flaw was found in the SFTP server message decoding logic of libssh. The issue ... A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service. Scope: local bookworm: resolved bullse

CVE-2025-5351 [MEDIUM] CVE-2025-5351: libssh - A flaw was found in the key export functionality of libssh. The issue occurs in ... A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in hea

CVE-2023-2283 [MEDIUM] CVE-2023-2283: libssh - A vulnerability was found in libssh, where the authentication check of the conne... A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritte

CVE-2023-1667 [MEDIUM] CVE-2023-1667: libssh - A NULL pointer dereference was found In libssh during re-keying with algorithm g... A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service. Scope: local bookworm: resolved (fixed in 0.10.5-1) bullseye: resolved (fixed in 0.9.7-0+deb11u1) forky: resolved (fixed in 0.10.5-1) sid: resolved (fixed in 0.10.5-1) trixie: resolved (fixed in 0.10.5-1)

CVE-2016-0739 [MEDIUM] CVE-2016-0739: libssh - libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1)... libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to 128 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug." Scope: local bookworm: resolved (fixed in 0.6.3-4.3