Bug 14410

Summary:	[CVE 21] libssh 0.9.7 CVEs found
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Arsenii <a.konovalov>
Component:	Net (ssh, samba, ssl, NM...)	Assignee:	Mikhail Novosyolov <m.novosyolov>
Status:	VERIFIED FIXED	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	normal
Priority:	Normal	CC:	a.proklov, pastordidi, v.potapov
Version:	All	Flags:	v.potapov: qa_verified+ a.konovalov: secteam_verified? a.proklov: published+
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:
Platform:	2021.1	ROSA Vulnerability identifier:
RPM Package:		ISO-related:
Bad POT generating:		Upstream:

Description Arsenii 2024-04-11 12:05:11 MSK

https://nvd.nist.gov/vuln/detail/CVE-2023-48795 MEDIUM
https://nvd.nist.gov/vuln/detail/CVE-2023-6004 MEDIUM
https://nvd.nist.gov/vuln/detail/CVE-2023-6918 MEDIUM

Comment 1 Aleksandr Proklov 2024-04-12 03:36:23 MSK

закрыто минорным обновлением версии

libssh	0.9.8-1

https://abf.io/build_lists/5019620
https://abf.io/build_lists/5019621
https://abf.io/build_lists/5019622
https://abf.io/build_lists/5019623
https://abf.io/build_lists/5019624

Comment 2 Aleksandr Proklov 2024-04-12 04:10:05 MSK

эта уязвимость затрагивает несколько проектов.

libssh2	1.10.0-3 закрыто патчем

https://abf.io/build_lists/5019630
https://abf.io/build_lists/5019631
https://abf.io/build_lists/5019632
https://abf.io/build_lists/5019633
https://abf.io/build_lists/5019634

Comment 3 Aleksandr Proklov 2024-04-12 04:12:43 MSK

filezilla - до версии 3.66.х не обновить т.к. нужен boost свежий. патчей отдельно не нашел.

Comment 4 Aleksandr Proklov 2024-04-12 04:16:06 MSK

openssh уже обновлена до версии 9.6p1 не подвержена CVE-2023-48795

Comment 5 Dmitry Postnikov 2024-04-12 15:00:27 MSK

*********************************
Обновление опубликовано в Тестинг

Comment 6 Vladimir Potapov 2024-04-17 09:36:51 MSK

libssh-0.9.8-1
https://abf.io/build_lists/5019620
https://abf.io/build_lists/5019621
https://abf.io/build_lists/5019622
https://abf.io/build_lists/5019623
https://abf.io/build_lists/5019624

libssh2-1.10.0-3
https://abf.io/build_lists/5019630
https://abf.io/build_lists/5019631
https://abf.io/build_lists/5019632
https://abf.io/build_lists/5019633
https://abf.io/build_lists/5019634
**************************** Advisory ***************************
CVEs fixed
*****************************************************************
QA Verified