A vulnerability in libssh could allow a remote attacker to execute arbitrary commands.
Package | net-libs/libssh on all architectures |
---|---|
Affected versions | < 0.9.3 |
Unaffected versions | >= 0.9.3 |
libssh is a multiplatform C library implementing the SSHv2 protocol on client and server side.
It was discovered that libssh incorrectly handled certain scp commands.
A remote attacker could trick a victim into using a specially crafted scp command, possibly resulting in the execution of arbitrary commands on the server.
There is no known workaround at this time.
All libssh users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/libssh-0.9.3"
Release date
March 15, 2020
Latest revision
March 15, 2020: 1
Severity
normal
Exploitable
remote
Bugzilla entries