Bug 32662

Summary:	CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack): libssh2
Product:	Mageia	Reporter:	papoteur <yvesbrungard>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	andrewsfarm, herman.viaene, marja11, sysadmin-bugs
Version:	9	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	https://github.com/libssh2/libssh2/issues/1290
Whiteboard:	MGA9-64-OK
Source RPM:	libssh2-1.10.0.mga9	CVE:	CVE-2023-48795
Status comment:
Bug Depends on:
Bug Blocks:	32641

Description papoteur 2023-12-28 14:05:27 CET

Description of problem:

See main report bug 32641

There is a PR upstream, but it doesn't seem to apply to the last release.

papoteur 2023-12-28 14:06:12 CET

Whiteboard: (none) => MGA9TOO

papoteur 2023-12-28 14:08:28 CET

CVE: (none) => CVE-2023-48795
Blocks: (none) => 32641

Comment 1 Lewis Smith 2023-12-31 20:19:22 CET

- libssh2 git:
 https://github.com/libssh2/libssh2/issues/1290
 https://github.com/libssh2/libssh2/pull/1291

We have newer version: 1.11.0 in Cauldron, but that was in September, so is unlikely to include the fix. Yves' comment 0 indicates care about the patch.

This SRPM is done by different packgers, so assigning the bug globally.

Assignee: bugsquad => pkg-bugs

Comment 2 papoteur 2024-01-01 11:24:07 CET

Release libssh2-1.11.0-2.mga10 updated with patch rediffed.

Whiteboard: MGA9TOO => (none)
Version: Cauldron => 9

Comment 3 papoteur 2024-01-01 11:27:27 CET

Patch also rediffed for Mageia 9 against libssh2-1.10.0
Source: libssh2-1.10.0-3.1.mga9
RPMS:
lib64ssh2-devel-1.10.0-3.1.mga9
lib64ssh2_1-1.10.0-3.1.mga9

Assignee: pkg-bugs => qa-bugs

Comment 4 papoteur 2024-01-01 11:29:25 CET

I don't know how to test.
Could be used in:
urpmq --whatrequires lib64ssh2_1
aria2
cargo
freefilesync
gfal2-plugin-sftp
lib64git2_1.3
lib64guac-client-rdp0
lib64guac-client-ssh0
lib64guac-client-vnc0
lib64virt0
lib64xine2
lib64xine2
mc
medusa
mlterm
nmap
php-ssh2
vlc-plugin-common

Comment 5 Marja Van Waes 2024-01-02 11:39:46 CET

Advisory added to SVN https://svnweb.mageia.org/advisories/32662.adv?view=markup&pathrev=15470

Please remove the "advisory" keyword if it needs to be changed.

CC: (none) => marja11
Keywords: (none) => advisory

Comment 6 Herman Viaene 2024-01-03 15:43:21 CET

MGA9-64 Plasma Wayland on HP Pavillion
No installation issues.
Used Freefilesync to display differences between own Documents folder and NFS-folder from desktopPC. Looks OK
Further using it, copied folder from NFS folder to own Documents folder, works OK.
Good to go.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA9-64-OK

Comment 7 Thomas Andrews 2024-01-04 01:51:38 CET

Thank you, Herman. Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Comment 8 Mageia Robot 2024-01-08 11:14:23 CET

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0002.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Nicolas Salguero 2024-01-19 16:12:02 CET

Blocks: (none) => 32748

Nicolas Salguero 2024-01-19 16:16:44 CET

Blocks: 32748 => (none)