Red Hat Security Advisory

RHSA-2016:0428

libssh2 security update

Released 2016-03-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) libssh2-1.4.3-10.el7_2.1
Red Hat Enterprise Linux Client Optional (v. 7) libssh2-devel-1.4.3-10.el7_2.1, libssh2-docs-1.4.3-10.el7_2.1
Red Hat Enterprise Linux ComputeNode (v. 7) libssh2-1.4.3-10.el7_2.1
Red Hat Enterprise Linux ComputeNode Optional (v. 7) libssh2-devel-1.4.3-10.el7_2.1, libssh2-docs-1.4.3-10.el7_2.1
Red Hat Enterprise Linux Desktop (v. 6) libssh2-1.4.2-2.el6_7.1
Red Hat Enterprise Linux Desktop Optional (v. 6) libssh2-devel-1.4.2-2.el6_7.1, libssh2-docs-1.4.2-2.el6_7.1
Red Hat Enterprise Linux HPC Node (v. 6) libssh2-1.4.2-2.el6_7.1
Red Hat Enterprise Linux HPC Node Optional (v. 6) libssh2-devel-1.4.2-2.el6_7.1, libssh2-docs-1.4.2-2.el6_7.1
Red Hat Enterprise Linux Server (v. 6) libssh2-1.4.2-2.el6_7.1, libssh2-1.4.2-2.el6_7.1.ppc
Red Hat Enterprise Linux Server (v. 7) libssh2-1.4.3-10.el7_2.1, libssh2-1.4.3-10.el7_2.1.ppc
Red Hat Enterprise Linux Server Optional (v. 6) libssh2-devel-1.4.2-2.el6_7.1, libssh2-devel-1.4.2-2.el6_7.1.ppc, libssh2-docs-1.4.2-2.el6_7.1
Red Hat Enterprise Linux Server Optional (v. 7) libssh2-devel-1.4.3-10.el7_2.1, libssh2-devel-1.4.3-10.el7_2.1.ppc, libssh2-docs-1.4.3-10.el7_2.1
Red Hat Enterprise Linux Workstation (v. 6) libssh2-1.4.2-2.el6_7.1
Red Hat Enterprise Linux Workstation (v. 7) libssh2-1.4.3-10.el7_2.1
Red Hat Enterprise Linux Workstation Optional (v. 6) libssh2-devel-1.4.2-2.el6_7.1, libssh2-docs-1.4.2-2.el6_7.1
Red Hat Enterprise Linux Workstation Optional (v. 7) libssh2-devel-1.4.3-10.el7_2.1, libssh2-docs-1.4.3-10.el7_2.1

Fixes 1 record

TI-2016-00704 CVE-2016-0787 · GHSA-6wmj-27wm-wwx6

The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates…

LOW 31

The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecif…

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.02591 Published 2016-04-13 Fixed CWE-200