CVE-2023-6918

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6918
A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2024:2504
https://access.redhat.com/security/cve/CVE-2023-6918 Mailing List Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2254997 Issue Tracking Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/ Mailing List Vendor Advisory
https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/ Release Notes
https://www.libssh.org/security/advisories/CVE-2023-6918.txt Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*
cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
History

30 Apr 2024, 15:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:2504 -

10 Jan 2024, 16:14

Type Values Removed Values Added
First Time Fedoraproject
Fedoraproject fedora
CPE cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:a:libssh:libssh:-:*:*:*:*:*:*:*
cpe:2.3:a:libssh2:libssh2:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*		 cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/ - Third Party Advisory

10 Jan 2024, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/ -

04 Jan 2024, 20:21

Type Values Removed Values Added
References () https://www.libssh.org/security/advisories/CVE-2023-6918.txt - () https://www.libssh.org/security/advisories/CVE-2023-6918.txt - Vendor Advisory
CVSS v2 : unknown
v3 : 9.1 		v2 : unknown
v3 : 5.3

03 Jan 2024, 08:15

Type Values Removed Values Added
References
  • () https://www.libssh.org/security/advisories/CVE-2023-6918.txt -

02 Jan 2024, 16:00

Type Values Removed Values Added
First Time Redhat enterprise Linux
Libssh libssh
Redhat
Libssh
Libssh2
Libssh2 libssh2
CPE cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:a:libssh:libssh:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*
cpe:2.3:a:libssh2:libssh2:-:*:*:*:*:*:*:*
References () https://access.redhat.com/security/cve/CVE-2023-6918 - () https://access.redhat.com/security/cve/CVE-2023-6918 - Mailing List, Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2254997 - () https://bugzilla.redhat.com/show_bug.cgi?id=2254997 - Issue Tracking, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/ - Mailing List, Vendor Advisory
References () https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/ - () https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/ - Release Notes
CVSS v2 : unknown
v3 : 3.7 		v2 : unknown
v3 : 9.1

22 Dec 2023, 04:15

Type Values Removed Values Added
Summary
  • (es) Se encontró un fallo en la capa abstracta de implementación de libssh para operaciones de resumen de mensajes (MD) implementadas por diferentes backends criptográficos compatibles. Los valores de retorno de estos no se verificaron correctamente, lo que podría causar fallas en situaciones de poca memoria, desreferencias NULL, fallas o uso de la memoria no inicializada como entrada para el KDF. En este caso, las claves que no coinciden resultarán en fallas de descifrado/integridad, lo que terminará la conexión.
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/ -

19 Dec 2023, 00:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-19 00:15

Updated : 2024-04-30 15:15

NVD link : CVE-2023-6918

Mitre link : CVE-2023-6918

CVE.ORG link : CVE-2023-6918

JSON object : View

Products Affected

redhat

  • enterprise_linux

libssh

  • libssh

fedoraproject

  • fedora
CWE
CWE-252

Unchecked Return Value