发布于3月6日3月6日 Members Huawei EulerOS: CVE-2023-2283: libssh security update Severity 6 CVSS (AV:N/AC:L/Au:N/C:P/I:P/A:N) Published 05/26/2023 Created 08/10/2023 Added 08/09/2023 Modified 01/28/2025 Description A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK. Solution(s) huawei-euleros-2_0_sp9-upgrade-libssh References https://attackerkb.com/topics/cve-2023-2283 CVE - 2023-2283 EulerOS-SA-2023-2616
参与讨论
你可立刻发布并稍后注册。 如果你有帐户，立刻登录发布帖子。
注意：你的帖子需要版主批准后才能看到。