TI-2023-02141 Aliases CVE-2023-2283 GHSA-h9jw-g3xj-5hwg

Improper authentication in libssh

LOW 31CWE-287Published 2023-05-26 · Updated 2025-11-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: Partial Red Hat: 6 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-287.

Summary

A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.

Why it matters now

EPSS 0.01061 64th percentileScored 2026-11-07

Fix Partial Red Hat: 3 advisoriesRed Hat: 6 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	libssh	libssh-2	—	No fix listed	CNA

libssh Vendor— Affected libssh-2 Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:libssh:libssh::::::::	0.9.1 – 0.9.6; 0.10.0 – 0.10.4	Vulnerable	libssh
cpe:2.3:o:fedoraproject:fedora:37:::::::*	37	Vulnerable	Fedoraproject
cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*	8.0	Vulnerable	Red Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*	9.0	Vulnerable	Red Hat

cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:* Versions 0.9.1 – 0.9.6; 0.10.0 – 0.10.4 Vulnerable ·libssh
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat

Remediation

Red Hat 3 advisories

RHSA-2024:0538 Released 2024-01-29 · Red Hat rating Moderate
libssh security update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) libssh-devel-0.9.6-4.el8_6
- Red Hat Enterprise Linux BaseOS EUS (v.8.6) libssh-0.9.6-4.el8_6, libssh-config-0.9.6-4.el8_6
RHSA-2023:6643 Released 2023-11-07 · Red Hat rating Moderate
libssh security update
- Red Hat Enterprise Linux AppStream (v. 9) libssh-devel-0.10.4-11.el9
- Red Hat Enterprise Linux BaseOS (v. 9) libssh-0.10.4-11.el9, libssh-config-0.10.4-11.el9
RHSA-2023:3839 Released 2023-06-27 · Red Hat rating Moderate
libssh security update
- Red Hat Enterprise Linux AppStream (v. 8) libssh-devel-0.9.6-10.el8_8
- Red Hat Enterprise Linux BaseOS (v. 8) libssh-0.9.6-10.el8_8, libssh-config-0.9.6-10.el8_8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2023-05-26
libssh — FEDORA-2023-5fa5ca2043
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2023-01564 NULL pointer dereference in libsshPriority LOW 32
Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
CloudForms Management Engine 5	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2023:3839
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2023:6643
Red Hat Enterprise Linux AppStream EUS (v.8.6)	Fixed	RHSA-2024:0538
Red Hat Enterprise Linux BaseOS (v. 8)	Fixed	RHSA-2023:3839
Red Hat Enterprise Linux BaseOS (v. 9)	Fixed	RHSA-2023:6643
Red Hat Enterprise Linux BaseOS EUS (v.8.6)	Fixed	RHSA-2024:0538

Timeline

2026-10-02 Threatist record created from CVE-2023-2283
2026-10-03 Alias added: GHSA-h9jw-g3xj-5hwg

References

Advisory 5

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences