NULL pointer dereference in libssh - CVE-2020-16135

Vulnerability identifier: #VU34008

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-16135

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in tftpserver.c if ssh_buffer_new returns NULL. A remote attacker can perform a denial of service (DoS) attack.

libssh
Gentoo Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Ubuntu
Fedora
libssh (Alpine package)
libssh-4 (Ubuntu package)
libssh (Red Hat package)
libssh
libssh4-debuginfo-32bit
libssh4-32bit
libssh-config
libssh-debugsource
libssh4
libssh-devel
libssh4-debuginfo
libssh4-32bit-debuginfo
Cloud Pak for Security (CP4S)
Oracle Communications Cloud Native Core Policy
Migration Toolkit for Containers
Red Hat OpenShift Serverless
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Advanced Cluster Security for Kubernetes
Red Hat OpenStack
PowerStore X
PowerStore T
Storage Resource Manager
EMC Cloud Tiering Appliance
Dell EMC Storage Monitoring and Reporting (SMR)
RSA Authentication Manager

Install updates from vendor's website.

libssh - update to 0.9.5
libssh (Alpine package) - update to 0.9.5-r0
Cloud Pak for Security (CP4S) - update to 1.10.7.0
libssh-4 (Ubuntu package) - addressed in versions 0.6.3-4.3ubuntu0.6, 0.8.0~20170825.94fa1e38-1ubuntu0.7, 0.9.3-2ubuntu2.1
libssh (Red Hat package) - update to 0.9.4-3.el8
libssh - addressed in versions 0.9.5-1.fc32, 0.9.5-1.fc33
libssh4-debuginfo-32bit - update to 0.9.8-3.12.2
libssh4-32bit - addressed in versions 0.9.8-3.12.2, 0.9.8-150200.13.3.1
libssh-config - addressed in versions 0.9.8-3.12.2, 0.9.8-150200.13.3.1
libssh-debugsource - addressed in versions 0.9.8-3.12.2, 0.9.8-150200.13.3.1
libssh4 - addressed in versions 0.9.8-3.12.2, 0.9.8-150200.13.3.1
libssh-devel - addressed in versions 0.9.8-3.12.2, 0.9.8-150200.13.3.1
libssh4-debuginfo - addressed in versions 0.9.8-3.12.2, 0.9.8-150200.13.3.1
libssh4-32bit-debuginfo - update to 0.9.8-150200.13.3.1
Migration Toolkit for Containers - update to 1.5.4
Red Hat OpenShift Serverless - update to 1.20.0
Red Hat Advanced Cluster Management for Kubernetes - update to 2.2.10
PowerStore X - update to 3.2.1.4-2386214
Red Hat Advanced Cluster Security for Kubernetes - update to 3.67
PowerStore T - update to 4.0.0.2-2365061
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.10.0.3
Storage Resource Manager - update to 4.10.0.3
RSA Authentication Manager - update to 8.7 SP2 Patch 2
EMC Cloud Tiering Appliance - update to 13.2.0.2.29
Red Hat OpenStack - update to 16.2

• https://bugs.libssh.org/rLIBSSHe631ebb3e2247dd25e9678e6827c20dc73b73238
• https://bugs.libssh.org/T232
• https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120
• https://lists.debian.org/debian-lts-announce/2020/07/msg00034.html

• NULL pointer dereference in libssh
• NULL pointer dereference in libssh (Alpine package)
• Gentoo update for libssh
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Red Hat Enterprise Linux 8 update for libssh
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• SUSE update for libssh
• SUSE update for libssh
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Multiple vulnerabilities in Dell PowerStore X
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 3.67
• Multiple vulnerabilities in Red Hat OpenShift Serverless 1.20
• Multiple vulnerabilities in Red Hat OpenStack 16.2 packages
• Multiple vulnerabilities in Migration Toolkit for Containers 1.5
• Multiple vulnerabilities in Dell PowerStore T Family
• Ubuntu update for libssh
• Fedora 33 update for libssh
• Fedora 32 update for libssh
• RSA Authentication Manager update for third-party components
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.2