Unchecked Return Value Affecting libssh-config package, versions <0.9.8-150400.3.3.1


Severity

Recommended
high

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
0.13% (50th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES155-LIBSSHCONFIG-6180199
  • published19 Jan 2024
  • disclosed18 Jan 2024

Introduced: 18 Jan 2024

CVE-2023-6918  (opens in a new tab)
CWE-252  (opens in a new tab)

How to fix?

Upgrade SLES:15.5 libssh-config to version 0.9.8-150400.3.3.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh-config package and not the libssh-config package as distributed by SLES. See How to fix? for SLES:15.5 relevant fixed versions and status.

A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.

CVSS Base Scores

version 3.1