Security Vulnerabilities fixed in libssh RHSA-2020:4545

Description

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. The following packages have been upgraded to a later upstream version: libssh (0.9.4). (BZ#1804797) Security Fix(es): * libssh: denial of service when handling AES-CTR (or DES) ciphers (CVE-2020-1730) * libssh: unsanitized location in scp could lead to unwanted command execution (CVE-2019-14889) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

Affected Applications

libssh

CVE References

CVE-2019-14889 CVE-2020-1730

Other References

https://access.redhat.com/errata/RHSA-2020:4545