Bug 1218126 - VUL-0: CVE-2023-48795: libssh: prefix truncation breaking ssh channel integrity
Summary: VUL-0: CVE-2023-48795: libssh: prefix truncation breaking ssh channel integrity
Status: IN_PROGRESS
Alias: None
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Critical
Target Milestone: ---
Assignee: James McDonough
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/387549/
Whiteboard:
Keywords:
Depends on:
Blocks: CVE-2023-48795
  Show dependency treegraph
 
Reported: 2023-12-16 18:10 UTC by Marcus Meissner
Modified: 2024-02-20 20:36 UTC (History)
17 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---
carlos.lopez: needinfo? (jmcdonough)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Marcus Meissner 2023-12-17 12:47:25 UTC
- libssh.org (aka libssh): supports chacha20-poly1305 since 0.8.0:
  SLES 12 SP5, SLES 15 SP1 and newer are affected.
Comment 2 Marcus Meissner 2023-12-18 08:34:23 UTC
not sure what upsrteam libssh will do yet, but a short term workaround will be to disable the chacha20-poly1305 cipher.
Comment 3 Marcus Meissner 2023-12-18 16:57:55 UTC
https://gitlab.com/libssh/libssh-mirror/-/commits/master/?ref_type=HEADS

libssh has commits now fixing the issue
Comment 4 Marcus Meissner 2023-12-19 08:23:06 UTC
upostream has released 0.9.8 and 0.10.6 to fix this and other issues.
Comment 5 Marcus Meissner 2023-12-20 13:03:13 UTC
Factory is fixed by Andreas.
Comment 7 OBSbugzilla Bot 2023-12-21 13:35:03 UTC
This is an autogenerated message for OBS integration:
This bug (1218126) was mentioned in
https://build.opensuse.org/request/show/1134431 Factory / libssh
Comment 8 OBSbugzilla Bot 2023-12-23 11:35:02 UTC
This is an autogenerated message for OBS integration:
This bug (1218126) was mentioned in
https://build.opensuse.org/request/show/1134726 Factory / libssh
Comment 13 Xuanke Han 2024-01-11 05:23:27 UTC
When could we release this fix for SLES12 SP5? Customer asked for this fix several times in recently days.
Comment 15 Marcus Meissner 2024-01-15 15:33:00 UTC
We are currently looking at both backport and version update opportunities.

SLES 15 SP4, SP5 will get a version update to the current release.
Comment 16 Maintenance Automation 2024-01-18 12:30:29 UTC
SUSE-SU-2024:0140-1: An update that solves five vulnerabilities can now be installed.

Category: security (important)
Bug References: 1211188, 1211190, 1218126, 1218186, 1218209
CVE References: CVE-2023-1667, CVE-2023-2283, CVE-2023-48795, CVE-2023-6004, CVE-2023-6918
Sources used:
openSUSE Leap 15.4 (src): libssh-0.9.8-150400.3.3.1, libssh-test-0.9.8-150400.3.3.1
openSUSE Leap Micro 5.3 (src): libssh-0.9.8-150400.3.3.1
openSUSE Leap Micro 5.4 (src): libssh-0.9.8-150400.3.3.1
openSUSE Leap 15.5 (src): libssh-0.9.8-150400.3.3.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): libssh-0.9.8-150400.3.3.1
SUSE Linux Enterprise Micro 5.3 (src): libssh-0.9.8-150400.3.3.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): libssh-0.9.8-150400.3.3.1
SUSE Linux Enterprise Micro 5.4 (src): libssh-0.9.8-150400.3.3.1
SUSE Linux Enterprise Micro 5.5 (src): libssh-0.9.8-150400.3.3.1
Basesystem Module 15-SP5 (src): libssh-0.9.8-150400.3.3.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): libssh-0.9.8-150400.3.3.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): libssh-0.9.8-150400.3.3.1
SUSE Linux Enterprise Real Time 15 SP4 (src): libssh-0.9.8-150400.3.3.1
SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): libssh-0.9.8-150400.3.3.1
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): libssh-0.9.8-150400.3.3.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): libssh-0.9.8-150400.3.3.1
SUSE Manager Proxy 4.3 (src): libssh-0.9.8-150400.3.3.1
SUSE Manager Retail Branch Server 4.3 (src): libssh-0.9.8-150400.3.3.1
SUSE Manager Server 4.3 (src): libssh-0.9.8-150400.3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 20 Ali Abdallah 2024-02-05 15:02:34 UTC
(In reply to Marcus Meissner from comment #15)
> We are currently looking at both backport and version update opportunities.

Any progress on the decision on how to proceed for older branches? 

PS: Backporting doesn't seem trivial at all, IMHO a version update to 0.9.8 would be a safer and easier option
Comment 23 Pedro Monreal Gonzalez 2024-02-06 10:56:49 UTC
I just submitted the version updates:
  * SUSE:SLE-15-SP1:Update: https://build.suse.de/request/show/320674
  * SUSE:SLE-12-SP5:Update: https://build.suse.de/request/show/320683
Comment 24 Pedro Monreal Gonzalez 2024-02-06 10:59:34 UTC
@James McDonough, there is an open review for the submissions. Please, provide feedback. TIA
Comment 25 Maintenance Automation 2024-02-19 08:30:03 UTC
SUSE-SU-2024:0525-1: An update that solves nine vulnerabilities and contains one feature can now be installed.

Category: security (important)
Bug References: 1158095, 1168699, 1174713, 1189608, 1211188, 1211190, 1218126, 1218186, 1218209
CVE References: CVE-2019-14889, CVE-2020-16135, CVE-2020-1730, CVE-2021-3634, CVE-2023-1667, CVE-2023-2283, CVE-2023-48795, CVE-2023-6004, CVE-2023-6918
Jira References: PED-7719
Sources used:
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): libssh-0.9.8-150200.13.3.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): libssh-0.9.8-150200.13.3.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): libssh-0.9.8-150200.13.3.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): libssh-0.9.8-150200.13.3.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): libssh-0.9.8-150200.13.3.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): libssh-0.9.8-150200.13.3.1
SUSE Enterprise Storage 7.1 (src): libssh-0.9.8-150200.13.3.1
SUSE Linux Enterprise Micro 5.1 (src): libssh-0.9.8-150200.13.3.1
SUSE Linux Enterprise Micro 5.2 (src): libssh-0.9.8-150200.13.3.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src): libssh-0.9.8-150200.13.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 26 Maintenance Automation 2024-02-20 20:36:46 UTC
SUSE-SU-2024:0539-1: An update that solves nine vulnerabilities and contains one feature can now be installed.

Category: security (important)
Bug References: 1158095, 1168699, 1174713, 1189608, 1211188, 1211190, 1218126, 1218186, 1218209
CVE References: CVE-2019-14889, CVE-2020-16135, CVE-2020-1730, CVE-2021-3634, CVE-2023-1667, CVE-2023-2283, CVE-2023-48795, CVE-2023-6004, CVE-2023-6918
Jira References: PED-7719
Sources used:
SUSE Linux Enterprise Software Development Kit 12 SP5 (src): libssh-0.9.8-3.12.2
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): libssh-0.9.8-3.12.2
SUSE Linux Enterprise Server 12 SP5 (src): libssh-0.9.8-3.12.2
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): libssh-0.9.8-3.12.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.