A vulnerability in libssh could allow a remote attacker to execute arbitrary commands.
|Package||net-libs/libssh on all architectures|
|Affected versions||< 0.9.3|
|Unaffected versions||>= 0.9.3|
libssh is a multiplatform C library implementing the SSHv2 protocol on client and server side.
It was discovered that libssh incorrectly handled certain scp commands.
A remote attacker could trick a victim into using a specially crafted scp command, possibly resulting in the execution of arbitrary commands on the server.
There is no known workaround at this time.
All libssh users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/libssh-0.9.3"
March 15, 2020
March 15, 2020: 1