Vulnerability Bulletins |
DSA-4322 libssh - security update |
|
| Affected software | Debian |
|
Peter Winter-Smith of NCC Group discovered that libssh, a tiny C SSHlibrary, contains an authentication bypass vulnerability in the servercode. An attacker can take advantage of this flaw to successfullyauthenticate without any credentials by presenting the server anSSH2_MSG_USERAUTH_SUCCESS message in place of theSSH2_MSG_USERAUTH_REQUEST message which the server would expect toinitiate authentication. More info: https://www.debian.org/security/2018/dsa-4322 |
|