Incoming details.
=========== Description =========== When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of ssh_scp_new(), it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target. ================== Patch Availability ================== Patches addressing the issues have been posted to: https://www.libssh.org/security/ Additionally, libssh 0.9.3 and 0.8.8 have been issued as security releases to correct the defect. SSH administrators are advised to upgrade to these releases or apply the patch as soon as possible.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ead108fac74cf8a7b1b201848e872057718ed335 commit ead108fac74cf8a7b1b201848e872057718ed335 Author: Lars Wendler <polynomial-c@gentoo.org> AuthorDate: 2019-12-12 17:00:22 +0000 Commit: Lars Wendler <polynomial-c@gentoo.org> CommitDate: 2019-12-12 17:00:51 +0000 net-libs/libssh: Security bump to version 0.9.3 (CVE-2019-14889) Bug: https://bugs.gentoo.org/701598 Package-Manager: Portage-2.3.81, Repoman-2.3.20 Signed-off-by: Lars Wendler <polynomial-c@gentoo.org> net-libs/libssh/Manifest | 1 + net-libs/libssh/libssh-0.9.3.ebuild | 116 ++++++++++++++++++++++++++++++++++++ 2 files changed, 117 insertions(+)
Arches please stabilise.
amd64 stable
sparc stable
x86 stable
ia64 stable
arm stable
arm64 stable
hppa stable
ppc64 stable
ppc stable
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=78a2814f6e83699b6d46d6d28097e5a5d0fbecc4 commit 78a2814f6e83699b6d46d6d28097e5a5d0fbecc4 Author: Andreas Sturmlechner <asturm@gentoo.org> AuthorDate: 2020-01-26 10:53:50 +0000 Commit: Andreas Sturmlechner <asturm@gentoo.org> CommitDate: 2020-01-26 10:54:49 +0000 net-libs/libssh: Drop 0.9.0 Bug: https://bugs.gentoo.org/701598 Package-Manager: Portage-2.3.85, Repoman-2.3.20 Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org> net-libs/libssh/Manifest | 1 - net-libs/libssh/files/libssh-0.9.0-libressl.patch | 33 ------ net-libs/libssh/libssh-0.9.0.ebuild | 117 ---------------------- 3 files changed, 151 deletions(-)
Cleanup done, security please proceed.
anyways, KDE proj out
New GLSA request filed.
This issue was resolved and addressed in GLSA 202003-27 at https://security.gentoo.org/glsa/202003-27 by GLSA coordinator Thomas Deutschmann (whissi).
