Bug 460620

Summary:	<net-libs/libssh-0.5.4: DoS vulnerability (CVE-2013-0176)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	netmon
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B3 [noglsa]
Package list:		Runtime testing required:	---

Description GLSAMaker/CVETool Bot gentoo-dev

2013-03-06 23:43:28 UTC

CVE-2013-0176 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0176):
  The publickey_from_privatekey function in libssh before 0.5.4, when no
  algorithm is matched during negotiations, allows remote attackers to cause a
  denial of service (NULL pointer dereference and crash) via a "Client:
  Diffie-Hellman Key Exchange Init" packet.


Maintainers, is =net-libs/libssh-0.5.4 ready for stabilization?

Comment 1 Tim Harder gentoo-dev

2013-03-07 04:58:12 UTC

Arches go ahead.

Comment 2 Agostino Sarubbo gentoo-dev

2013-03-07 18:02:15 UTC

amd64 stable

Comment 3 Agostino Sarubbo gentoo-dev

2013-03-07 18:04:53 UTC

x86 stable

Comment 4 Agostino Sarubbo gentoo-dev

2013-03-09 11:03:00 UTC

ppc64 stable

Comment 5 Agostino Sarubbo gentoo-dev

2013-03-09 11:25:54 UTC

ppc stable

Comment 6 Sean Amoss (RETIRED) gentoo-dev

2013-03-11 22:33:25 UTC

GLSA vote: no

Comment 7 Michael Palimaka (kensington) gentoo-dev

2013-03-14 15:38:16 UTC

Vulnerable version removed.

Comment 8 Tobias Heinlein (RETIRED) gentoo-dev

2013-03-24 20:23:58 UTC

NO too, closing.