Bug 12942 - libssh new security issue CVE-2014-0017
Summary: libssh new security issue CVE-2014-0017
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/589740/
Whiteboard: MGA3TOO advisory MGA4-64-OK MGA4-32-O...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2014-03-05 13:44 CET by David Walser
Modified: 2014-03-06 16:51 CET (History)
3 users (show)

See Also:
Source RPM: libssh-0.5.5-2.mga4.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2014-03-05 13:44:08 CET
libssh 0.6.3 has been announced on March 4, fixing a security issue:
http://www.libssh.org/2014/03/04/libssh-0-6-3-security-release/

Updated package uploaded for Cauldron.

Patched packages uploaded for Mageia 3 and Mageia 4.

Advisory:
========================

Updated libssh packages fix security vulnerability:

When using libssh before 0.6.3, a libssh-based server, when accepting a new
connection, forks and the child process handles the request. The RAND_bytes()
function of openssl doesn't reset its state after the fork, but simply adds
the current process id (getpid) to the PRNG state, which is not guaranteed to
be unique. The most important consequence is that servers using EC (ECDSA) or
DSA certificates may under certain conditions leak their private key
(CVE-2014-0017).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0017
http://www.libssh.org/2014/03/04/libssh-0-6-3-security-release/
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0017
========================

Updated packages in core/updates_testing:
========================
libssh4-0.5.4-1.1.mga3
libssh-devel-0.5.4-1.1.mga3
libssh4-0.5.5-2.1.mga4
libssh-devel-0.5.5-2.1.mga4

from SRPMS:
libssh-0.5.4-1.1.mga3.src.rpm
libssh-0.5.5-2.1.mga4.src.rpm

Reproducible: 

Steps to Reproduce:
David Walser 2014-03-05 13:44:14 CET

Whiteboard: (none) => MGA3TOO

Comment 1 Dave Hodgins 2014-03-05 16:12:29 CET
No poc, so just testing that ssh server still works. Testing shortly.

CC: (none) => davidwhodgins
Whiteboard: MGA3TOO => MGA3TOO advisory

Comment 2 Dave Hodgins 2014-03-05 17:32:31 CET
Testing complete on Mageia 3 and 4, i586 and x86_64.

Someone from the sysadmin team please push 12942.adv to updates.

Keywords: (none) => validated_update
Whiteboard: MGA3TOO advisory => MGA3TOO advisory MGA4-64-OK MGA4-32-OK MGA3-64-OK MGA3-32-OK
CC: (none) => sysadmin-bugs

Comment 3 Thomas Backlund 2014-03-06 00:27:00 CET
Update pushed:
http://advisories.mageia.org/MGASA-2014-0119.html

Status: NEW => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED

David Walser 2014-03-06 16:51:01 CET

URL: (none) => http://lwn.net/Vulnerabilities/589740/


Note You need to log in before you can comment on or make changes to this bug.