Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 810517 (CVE-2021-3634)

Summary: <net-libs/libssh-0.9.6: Heap buffer overflow (CVE-2021-3634)
Product: Gentoo Security Reporter: Sam James <sam>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal    
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: B2 [glsa+]
Package list:
Runtime testing required: ---
Bug Depends on: 810529    
Bug Blocks:    

Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-08-26 18:55:31 UTC
Description:
"CVE-2021-3634: Fix possible heap-buffer overflow when rekeying with different key exchange mechanism"

See https://www.libssh.org/2021/08/26/libssh-0-9-6-security-release/.
Comment 1 Larry the Git Cow gentoo-dev 2021-08-26 19:30:18 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3019db6eff789ef6351db4dc014af45dda09e7dd

commit 3019db6eff789ef6351db4dc014af45dda09e7dd
Author:     Lars Wendler <polynomial-c@gentoo.org>
AuthorDate: 2021-08-26 19:29:59 +0000
Commit:     Lars Wendler <polynomial-c@gentoo.org>
CommitDate: 2021-08-26 19:29:59 +0000

    net-libs/libssh: Security bump to version 0.9.6 (CVE-2021-3634)
    
    Bug: https://bugs.gentoo.org/810517
    Signed-off-by: Lars Wendler <polynomial-c@gentoo.org>

 net-libs/libssh/Manifest            |   1 +
 net-libs/libssh/libssh-0.9.6.ebuild | 118 ++++++++++++++++++++++++++++++++++++
 2 files changed, 119 insertions(+)
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-08-26 19:42:55 UTC
Thank you!
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-09-04 21:54:49 UTC
Please cleanup.
Comment 4 Larry the Git Cow gentoo-dev 2021-09-04 22:01:12 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=85b0e294af7943ec6bc8e0d6e13162bc98ccf23e

commit 85b0e294af7943ec6bc8e0d6e13162bc98ccf23e
Author:     Andreas Sturmlechner <asturm@gentoo.org>
AuthorDate: 2021-09-04 21:56:51 +0000
Commit:     Andreas Sturmlechner <asturm@gentoo.org>
CommitDate: 2021-09-04 22:00:49 +0000

    net-libs/libssh: Cleanup vulnerable 0.9.5
    
    Bug: https://bugs.gentoo.org/810517
    Package-Manager: Portage-3.0.22, Repoman-3.0.3
    Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org>

 net-libs/libssh/Manifest            |   1 -
 net-libs/libssh/libssh-0.9.5.ebuild | 118 ------------------------------------
 2 files changed, 119 deletions(-)
Comment 5 Andreas Sturmlechner gentoo-dev 2021-09-04 22:02:09 UTC
Cleanup done, kde proj out.
Comment 6 Larry the Git Cow gentoo-dev 2023-12-22 09:06:09 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=174be492d35afaa268c5b3dc28edc79fee8cacf4

commit 174be492d35afaa268c5b3dc28edc79fee8cacf4
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2023-12-22 09:05:35 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2023-12-22 09:06:04 +0000

    [ GLSA 202312-05 ] libssh: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/810517
    Bug: https://bugs.gentoo.org/905746
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>

 glsa-202312-05.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)