Bug 32662 - CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack): libssh2
Summary: CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Atta...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: https://github.com/libssh2/libssh2/is...
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks: 32641
  Show dependency tree / graph
 
Reported: 2023-12-28 14:05 CET by papoteur
Modified: 2024-01-19 16:16 CET (History)
4 users (show)

See Also:
Source RPM: libssh2-1.10.0.mga9
CVE: CVE-2023-48795
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description papoteur 2023-12-28 14:05:27 CET 
Description of problem:

See main report bug 32641

There is a PR upstream, but it doesn't seem to apply to the last release.
papoteur 2023-12-28 14:06:12 CET

Whiteboard: (none) => MGA9TOO

papoteur 2023-12-28 14:08:28 CET

CVE: (none) => CVE-2023-48795
Blocks: (none) => 32641

Comment 1 Lewis Smith 2023-12-31 20:19:22 CET 
- libssh2 git:
 https://github.com/libssh2/libssh2/issues/1290
 https://github.com/libssh2/libssh2/pull/1291

We have newer version: 1.11.0 in Cauldron, but that was in September, so is unlikely to include the fix. Yves' comment 0 indicates care about the patch.

This SRPM is done by different packgers, so assigning the bug globally.

Assignee: bugsquad => pkg-bugs

Comment 2 papoteur 2024-01-01 11:24:07 CET 
Release libssh2-1.11.0-2.mga10 updated with patch rediffed.

Whiteboard: MGA9TOO => (none)
Version: Cauldron => 9

Comment 3 papoteur 2024-01-01 11:27:27 CET 
Patch also rediffed for Mageia 9 against libssh2-1.10.0
Source: libssh2-1.10.0-3.1.mga9
RPMS:
lib64ssh2-devel-1.10.0-3.1.mga9
lib64ssh2_1-1.10.0-3.1.mga9

Assignee: pkg-bugs => qa-bugs

Comment 4 papoteur 2024-01-01 11:29:25 CET 
I don't know how to test.
Could be used in:
urpmq --whatrequires lib64ssh2_1
aria2
cargo
freefilesync
gfal2-plugin-sftp
lib64git2_1.3
lib64guac-client-rdp0
lib64guac-client-ssh0
lib64guac-client-vnc0
lib64virt0
lib64xine2
lib64xine2
mc
medusa
mlterm
nmap
php-ssh2
vlc-plugin-common
Comment 5 Marja Van Waes 2024-01-02 11:39:46 CET 
Advisory added to SVN https://svnweb.mageia.org/advisories/32662.adv?view=markup&pathrev=15470

Please remove the "advisory" keyword if it needs to be changed.

CC: (none) => marja11
Keywords: (none) => advisory

Comment 6 Herman Viaene 2024-01-03 15:43:21 CET 
MGA9-64 Plasma Wayland on HP Pavillion
No installation issues.
Used Freefilesync to display differences between own Documents folder and NFS-folder from desktopPC. Looks OK
Further using it, copied folder from NFS folder to own Documents folder, works OK.
Good to go.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA9-64-OK

Comment 7 Thomas Andrews 2024-01-04 01:51:38 CET 
Thank you, Herman. Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Comment 8 Mageia Robot 2024-01-08 11:14:23 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0002.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Nicolas Salguero 2024-01-19 16:12:02 CET

Blocks: (none) => 32748

Nicolas Salguero 2024-01-19 16:16:44 CET

Blocks: 32748 => (none)
Note You need to log in before you can comment on or make changes to this bug.