CVE-2023-2283: GHSL-2023-085: Authentication bypass in libssh - CVE-2023-2283
A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in thepkiverifydatasignature function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value rc, which is initialized to SSHERROR and later rewritten to save the return value of the function call pkikeycheckhashcompatible. The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls goto error returning SSHOK.
Other sources
libssh could allow a remote attacker to bypass security restrictions, caused by a memory allocation flaw in thepkiverifydatasignature function. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass the authentication check of the connecting client.
— IBM
The authentication check of the connecting client can be bypassed in the function pkiverifydatasignature in circumstances of memory allocation problems. This may happen f.e. if not enough memory or the memory usage is limited.
The problem is caused by the return value rc, which is initialized to SSHERROR and later rewritten to save the return value of the function call pkikeycheckhashcompatible. The value of the variable is not changed between this point and the cryptographic verification, therefore any error between them calls goto error returning SSHOK.
— Red Hat
The public key signature checking code in pkiverifydatasignature has a logic bug, which, under certain conditions, could enable an attacker to bypass the check.
— GitHub Security Lab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libsshto a version that resolves this vulnerability.Fixed in 0:0.9.6-10.el8_8
Event History
Frequently Asked Questions
What is CVE-2023-2283?
CVE-2023-2283 is a vulnerability found in libssh that allows the authentication check of the connecting client to be bypassed.
What is the severity of CVE-2023-2283?
The severity of CVE-2023-2283 is medium with a CVSS score of 6.5.
How does CVE-2023-2283 affect Libssh?
CVE-2023-2283 affects Libssh versions 0.9.1 to 0.9.6 and versions 0.10.0 to 0.10.4.
How can I fix CVE-2023-2283?
To fix CVE-2023-2283, update to libssh version 0.9.6-10.el8_8 or apply the necessary patches from the official sources.
Where can I find more information about CVE-2023-2283?
You can find more information about CVE-2023-2283 on the official Red Hat and libssh websites.