SUSE-SU-2020:3551-1: moderate: Security update for libssh2_org
sle-updates at lists.suse.com
sle-updates at lists.suse.com
Fri Nov 27 10:21:59 MST 2020
SUSE Security Update: Security update for libssh2_org
______________________________________________________________________________
Announcement ID: SUSE-SU-2020:3551-1
Rating: moderate
References: #1130103 #1178083 SLE-16922
Cross-References: CVE-2019-17498 CVE-2019-3855 CVE-2019-3856
CVE-2019-3857 CVE-2019-3858 CVE-2019-3859
CVE-2019-3860 CVE-2019-3861 CVE-2019-3862
CVE-2019-3863
Affected Products:
SUSE Linux Enterprise Server for SAP 15
SUSE Linux Enterprise Server 15-LTSS
SUSE Linux Enterprise Module for Basesystem 15-SP2
SUSE Linux Enterprise Module for Basesystem 15-SP1
SUSE Linux Enterprise High Performance Computing 15-LTSS
SUSE Linux Enterprise High Performance Computing 15-ESPOS
______________________________________________________________________________
An update that fixes 10 vulnerabilities, contains one
feature is now available.
Description:
This update for libssh2_org fixes the following issues:
- Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and
bugfixes:
* adds ECDSA keys and host key support when using OpenSSL
* adds ED25519 key and host key support when using OpenSSL 1.1.1
* adds OpenSSH style key file reading
* adds AES CTR mode support when using WinCNG
* adds PEM passphrase protected file support for Libgcrypt and WinCNG
* adds SHA256 hostkey fingerprint
* adds libssh2_agent_get_identity_path() and
libssh2_agent_set_identity_path()
* adds explicit zeroing of sensitive data in memory
* adds additional bounds checks to network buffer reads
* adds the ability to use the server default permissions when creating
sftp directories
* adds support for building with OpenSSL no engine flag
* adds support for building with LibreSSL
* increased sftp packet size to 256k
* fixed oversized packet handling in sftp
* fixed building with OpenSSL 1.1
* fixed a possible crash if sftp stat gets an unexpected response
* fixed incorrect parsing of the KEX preference string value
* fixed conditional RSA and AES-CTR support
* fixed a small memory leak during the key exchange process
* fixed a possible memory leak of the ssh banner string
* fixed various small memory leaks in the backends
* fixed possible out of bounds read when parsing public keys from the
server
* fixed possible out of bounds read when parsing invalid PEM files
* no longer null terminates the scp remote exec command
* now handle errors when diffie hellman key pair generation fails
* improved building instructions
* improved unit tests
- Version update to 1.8.2: [bsc#1130103] Bug fixes:
* Fixed the misapplied userauth patch that broke 1.8.1
* moved the MAX size declarations from the public header
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server for SAP 15:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2020-3551=1
- SUSE Linux Enterprise Server 15-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-2020-3551=1
- SUSE Linux Enterprise Module for Basesystem 15-SP2:
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP2-2020-3551=1
- SUSE Linux Enterprise Module for Basesystem 15-SP1:
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2020-3551=1
- SUSE Linux Enterprise High Performance Computing 15-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-2020-3551=1
- SUSE Linux Enterprise High Performance Computing 15-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-2020-3551=1
Package List:
- SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64):
libssh2-1-1.9.0-4.13.1
libssh2-1-debuginfo-1.9.0-4.13.1
libssh2-devel-1.9.0-4.13.1
libssh2_org-debugsource-1.9.0-4.13.1
- SUSE Linux Enterprise Server for SAP 15 (x86_64):
libssh2-1-32bit-1.9.0-4.13.1
libssh2-1-32bit-debuginfo-1.9.0-4.13.1
- SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x):
libssh2-1-1.9.0-4.13.1
libssh2-1-debuginfo-1.9.0-4.13.1
libssh2-devel-1.9.0-4.13.1
libssh2_org-debugsource-1.9.0-4.13.1
- SUSE Linux Enterprise Module for Basesystem 15-SP2 (aarch64 ppc64le s390x x86_64):
libssh2-1-1.9.0-4.13.1
libssh2-1-debuginfo-1.9.0-4.13.1
libssh2-devel-1.9.0-4.13.1
libssh2_org-debugsource-1.9.0-4.13.1
- SUSE Linux Enterprise Module for Basesystem 15-SP2 (x86_64):
libssh2-1-32bit-1.9.0-4.13.1
libssh2-1-32bit-debuginfo-1.9.0-4.13.1
- SUSE Linux Enterprise Module for Basesystem 15-SP1 (aarch64 ppc64le s390x x86_64):
libssh2-1-1.9.0-4.13.1
libssh2-1-debuginfo-1.9.0-4.13.1
libssh2-devel-1.9.0-4.13.1
libssh2_org-debugsource-1.9.0-4.13.1
- SUSE Linux Enterprise Module for Basesystem 15-SP1 (x86_64):
libssh2-1-32bit-1.9.0-4.13.1
libssh2-1-32bit-debuginfo-1.9.0-4.13.1
- SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64):
libssh2-1-1.9.0-4.13.1
libssh2-1-debuginfo-1.9.0-4.13.1
libssh2-devel-1.9.0-4.13.1
libssh2_org-debugsource-1.9.0-4.13.1
- SUSE Linux Enterprise High Performance Computing 15-LTSS (x86_64):
libssh2-1-32bit-1.9.0-4.13.1
libssh2-1-32bit-debuginfo-1.9.0-4.13.1
- SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64):
libssh2-1-1.9.0-4.13.1
libssh2-1-debuginfo-1.9.0-4.13.1
libssh2-devel-1.9.0-4.13.1
libssh2_org-debugsource-1.9.0-4.13.1
- SUSE Linux Enterprise High Performance Computing 15-ESPOS (x86_64):
libssh2-1-32bit-1.9.0-4.13.1
libssh2-1-32bit-debuginfo-1.9.0-4.13.1
References:
https://www.suse.com/security/cve/CVE-2019-17498.html
https://www.suse.com/security/cve/CVE-2019-3855.html
https://www.suse.com/security/cve/CVE-2019-3856.html
https://www.suse.com/security/cve/CVE-2019-3857.html
https://www.suse.com/security/cve/CVE-2019-3858.html
https://www.suse.com/security/cve/CVE-2019-3859.html
https://www.suse.com/security/cve/CVE-2019-3860.html
https://www.suse.com/security/cve/CVE-2019-3861.html
https://www.suse.com/security/cve/CVE-2019-3862.html
https://www.suse.com/security/cve/CVE-2019-3863.html
https://bugzilla.suse.com/1130103
https://bugzilla.suse.com/1178083
More information about the sle-updates
mailing list