[ GLSA 202011-05 ] libssh

[GLSA]

Gentoo Linux Security Advisory

Title: libssh: Denial of Service (GLSA 202011-05)
Severity: normal
Exploitable: remote
Date: 2020-11-03
Bug(s): #734624
ID: 202011-05

Synopsis

A vulnerability in libssh could lead to a Denial of Service
condition.


Background

libssh is a multiplatform C library implementing the SSHv2 protocol on
client and server side.


Affected Packages

Package: net-libs/libssh
Vulnerable: < 0.9.5
Unaffected: >= 0.9.5
Architectures: All supported architectures


Description

libssh was found to have a NULL pointer dereference in tftpserver.c if
the function ssh_buffer_new returns NULL.


Impact

An attacker could cause a possible Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All libssh users should upgrade to the latest version: