net-libs/libssh2-9999 — Security Advisories

portage-ng glsa

▸ GLSA 202608-17 libssh2: Multiple Vulnerabilities this version unaffected installed copy vulnerable high remote 2026-08-20

Multiple vulnerabilities have been found in libssh2, the worst of which could result in remote code execution.

Announced: 2026-08-20
Revised: 2026-08-20
Access: remote
Bugs: #977961
Advisory: https://security.gentoo.org/glsa/202608-17

Affected packages

Package	Arch	Vulnerable	Unaffected
net-libs/libssh2	*	< 1.11.1-r2	>= 1.11.1-r2

Background

libssh2 is a library implementing the SSH2 protocol.

Description

Multiple vulnerabilities have been discovered in libssh2. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All libssh2 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/libssh2-1.11.1-r2"

References

▸ GLSA 201606-12 libssh and libssh2: Multiple vulnerabilities this version unaffected normal remote 2016-06-26

Multiple vulnerabilities have been found in libssh and libssh2, the worst of which allows remote attackers to cause Denial of Service.

Announced: 2016-06-26
Revised: 2016-06-26
Access: remote
Bugs: #533366 #575474 #575484
Advisory: https://security.gentoo.org/glsa/201606-12

Affected packages

Package	Arch	Vulnerable	Unaffected
net-libs/libssh	*	< 0.7.3	>= 0.7.3
net-libs/libssh2	*	< 1.7.0	>= 1.7.0

Background

libssh is a mulitplatform C library implementing the SSHv2 and SSHv1 protocol on client and server side.

Description

libssh and libssh2 both have a bits/bytes confusion bug and generate an abnormaly short ephemeral secret for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. The resulting secret is 128 bits long, instead of the recommended sizes of 1024 and 2048 bits respectively.

Additionally, a double free on dangling pointers in initial key exchange packets within libssh could leave dangling pointers in the session crypto structures. It is possible to send a malicious kexinit package to eventually cause a server to do a double-free before this fix. This could be used for a Denial of Service attack.

Impact

Remote attackers may gain access to confidential information due to the short keysize generated by libssh and libssh2, or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All libssh users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/libssh-0.7.3"

All libssh2 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/libssh2-1.7.0"