[SECURITY] Fedora 23 Update: libssh2-1.6.0-4.fc23

updates at fedoraproject.org updates at fedoraproject.org
Fri Feb 26 19:26:23 UTC 2016


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2016-215a2219b1
2016-02-26 15:30:48.278676
--------------------------------------------------------------------------------

Name        : libssh2
Product     : Fedora 23
Version     : 1.6.0
Release     : 4.fc23
URL         : http://www.libssh2.org/
Summary     : A library implementing the SSH2 protocol
Description :
libssh2 is a library implementing the SSH2 protocol as defined by
Internet Drafts: SECSH-TRANS(22), SECSH-USERAUTH(25),
SECSH-CONNECTION(23), SECSH-ARCH(20), SECSH-FILEXFER(06)*,
SECSH-DHGEX(04), and SECSH-NUMBERS(10).

--------------------------------------------------------------------------------
Update Information:

During the SSHv2 handshake when libssh2 is to get a suitable value for 'group
order' in the Diffle Hellman negotiation, it would pass in number of bytes to a
function that expected number of bits. This would result in the library
generating numbers using only an 8th the number of random bits than what were
intended: 128 or 256 bits instead of 1023 or 2047  Using such drastically
reduced amount of random bits for Diffie Hellman weakened the handshake security
significantly.  The Common Vulnerabilities and Exposures (CVE) project has
assigned the name CVE-2016-0787 to this issue.
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #1306021 - CVE-2016-0787 libssh2: bits/bytes confusion resulting in truncated Diffie-Hellman secret length
        https://bugzilla.redhat.com/show_bug.cgi?id=1306021
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program. Use
su -c 'yum update libssh2' at the command line.
For more information, refer to "Managing Software with yum",
available at https://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------


More information about the package-announce mailing list