| Summary: | <net-libs/libssh-0.9.3: unsanitized location in scp could lead to unwanted command execution (CVE-2019-14889) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Thomas Deutschmann (RETIRED) <whissi> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | Flags: | stable-bot:
sanity-check+
|
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://www.libssh.org/security/advisories/CVE-2019-14889.txt | ||
| Whiteboard: | A3 [glsa+ cve] | ||
| Package list: |
net-libs/libssh-0.9.3
|
Runtime testing required: | --- |
|
Description
Thomas Deutschmann (RETIRED)
2019-11-30 16:40:48 UTC
=========== Description =========== When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of ssh_scp_new(), it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target. ================== Patch Availability ================== Patches addressing the issues have been posted to: https://www.libssh.org/security/ Additionally, libssh 0.9.3 and 0.8.8 have been issued as security releases to correct the defect. SSH administrators are advised to upgrade to these releases or apply the patch as soon as possible. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ead108fac74cf8a7b1b201848e872057718ed335 commit ead108fac74cf8a7b1b201848e872057718ed335 Author: Lars Wendler <polynomial-c@gentoo.org> AuthorDate: 2019-12-12 17:00:22 +0000 Commit: Lars Wendler <polynomial-c@gentoo.org> CommitDate: 2019-12-12 17:00:51 +0000 net-libs/libssh: Security bump to version 0.9.3 (CVE-2019-14889) Bug: https://bugs.gentoo.org/701598 Package-Manager: Portage-2.3.81, Repoman-2.3.20 Signed-off-by: Lars Wendler <polynomial-c@gentoo.org> net-libs/libssh/Manifest | 1 + net-libs/libssh/libssh-0.9.3.ebuild | 116 ++++++++++++++++++++++++++++++++++++ 2 files changed, 117 insertions(+) Arches please stabilise. amd64 stable sparc stable x86 stable ia64 stable arm stable arm64 stable hppa stable ppc64 stable ppc stable The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=78a2814f6e83699b6d46d6d28097e5a5d0fbecc4 commit 78a2814f6e83699b6d46d6d28097e5a5d0fbecc4 Author: Andreas Sturmlechner <asturm@gentoo.org> AuthorDate: 2020-01-26 10:53:50 +0000 Commit: Andreas Sturmlechner <asturm@gentoo.org> CommitDate: 2020-01-26 10:54:49 +0000 net-libs/libssh: Drop 0.9.0 Bug: https://bugs.gentoo.org/701598 Package-Manager: Portage-2.3.85, Repoman-2.3.20 Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org> net-libs/libssh/Manifest | 1 - net-libs/libssh/files/libssh-0.9.0-libressl.patch | 33 ------ net-libs/libssh/libssh-0.9.0.ebuild | 117 ---------------------- 3 files changed, 151 deletions(-) Cleanup done, security please proceed. anyways, KDE proj out New GLSA request filed. This issue was resolved and addressed in GLSA 202003-27 at https://security.gentoo.org/glsa/202003-27 by GLSA coordinator Thomas Deutschmann (whissi). |
