Mageia alert MGASA-2016-0082 (libssh)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2016-0082: Updated libssh packages fix CVE-2016-0739 
Date:
    	     
 
Wed, 24 Feb 2016 18:07:04 +0100
Message-ID:
    	     
 
<20160224170704.CFFCD9F660@duvel.mageia.org>
MGASA-2016-0082 - Updated libssh packages fix CVE-2016-0739

Publication date: 24 Feb 2016
URL: http://advisories.mageia.org/MGASA-2016-0082.html
Type: security
Affected Mageia releases: 5
CVE: CVE-2016-0739

Description:
Updated libssh packages fix security vulnerability:

libssh versions 0.1 and above have a bits/bytes confusion bug and generate an
abnormally short ephemeral secret for the diffie-hellman-group1 and
diffie-hellman-group14 key exchange methods. The resulting secret is 128 bits
long, instead of the recommended sizes of 1024 and 2048 bits respectively.
Both client and server are are vulnerable, pre-authentication. This
vulnerability could be exploited by an eavesdropper with enough resources to
decrypt or intercept SSH sessions (CVE-2016-0739).

References:
- https://bugs.mageia.org/show_bug.cgi?id=17809
- https://www.libssh.org/2016/02/23/libssh-0-7-3-security-a...
- https://www.libssh.org/security/advisories/CVE-2016-0739.txt
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0739

SRPMS:
- 5/core/libssh-0.6.5-1.1.mga5