Advisories ยป MGASA-2016-0082

Updated libssh packages fix CVE-2016-0739

Publication date: 24 Feb 2016
Type: security
Affected Mageia releases : 5
CVE: CVE-2016-0739


Updated libssh packages fix security vulnerability:

libssh versions 0.1 and above have a bits/bytes confusion bug and generate an
abnormally short ephemeral secret for the diffie-hellman-group1 and
diffie-hellman-group14 key exchange methods. The resulting secret is 128 bits
long, instead of the recommended sizes of 1024 and 2048 bits respectively.
Both client and server are are vulnerable, pre-authentication. This
vulnerability could be exploited by an eavesdropper with enough resources to
decrypt or intercept SSH sessions (CVE-2016-0739).