Vulnerability · Published May 26, 2023 · Assigned by redhat
CVE-2023-2283
Medium 6.5
In plain English
A medium-severity improper authentication in libssh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | libssh | 0.9.6-10.el8_8 | ALSA-2023:3839 |
| AlmaLinux:9 | libssh | 0.10.4-11.el9 | ALSA-2023:6643 |
| AlmaLinux:8 | libssh-config | 0.9.6-10.el8_8 | ALSA-2023:3839 |
| AlmaLinux:9 | libssh-config | 0.10.4-11.el9 | ALSA-2023:6643 |
| AlmaLinux:8 | libssh-devel | 0.9.6-10.el8_8 | ALSA-2023:3839 |
| AlmaLinux:9 | libssh-devel | 0.10.4-11.el9 | ALSA-2023:6643 |
| Debian:12 | libssh | 0.10.5-1 | DEBIAN-CVE-2023-2283 |
| Debian:13 | libssh | 0.10.5-1 | DEBIAN-CVE-2023-2283 |
| Debian:14 | libssh | 0.10.5-1 | DEBIAN-CVE-2023-2283 |
| Rocky Linux:8 | libssh | 0:0.9.6-10.el8_8 | RLSA-2023:3839 |
| Ubuntu:22.04:LTS | libssh | 0.9.6-2ubuntu0.22.04.1 | USN-6138-1 |
| Ubuntu:22.04:LTS | libssh | 0.9.6-2ubuntu0.22.04.1 | UBUNTU-CVE-2023-2283 |
Affected products (as reported)
Weakness: CWE-287
References
- https://access.redhat.com/security/cve/CVE-2023-2283
- https://www.libssh.org/security/advisories/CVE-2023-2283.txt
- https://bugzilla.redhat.com/show_bug.cgi?id=2189736
- FEDORA-2023-5fa5ca2043 vendor-advisory
- http://packetstormsecurity.com/files/172861/libssh-0.9.6-0.10.4-pki_verify_data_signature-Authorization-Bypass.html
- GLSA-202312-05 vendor-advisory
- https://security.netapp.com/advisory/ntap-20240201-0005/
- http://seclists.org/fulldisclosure/2025/Feb/18