CVE-2016-0787
Fixed in a distro release EPSS 3%
The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."
Products: fedoraproject fedora, opensuse, libssh2, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.4 | libssh2 | 1.7.0-r0 |
| Debian 12 | libssh2 | 1.5.0-2.1 |
| Debian 13 | libssh2 | 1.5.0-2.1 |
| Debian 14 | libssh2 | 1.5.0-2.1 |
| Debian 6.0 | libssh2 | 1.2.6-1+deb6u2 |
| Debian 7 | libssh2 | 1.4.2-1.1+deb7u2 |
| Debian 8 | libssh2 | 1.4.3-4.1+deb8u1 |
| Red Hat Enterprise Linux 6 | libssh2 | 0:1.4.2-2.el6_7.1 |
| Red Hat Enterprise Linux 6 | libssh2-debuginfo | 0:1.4.2-2.el6_7.1 |
| Red Hat Enterprise Linux 6 | libssh2-devel | 0:1.4.2-2.el6_7.1 |
| Red Hat Enterprise Linux 6 | libssh2-docs | 0:1.4.2-2.el6_7.1 |
| Red Hat Enterprise Linux 7 | libssh2 | 0:1.4.3-10.el7_2.1 |
| Red Hat Enterprise Linux 7 | libssh2-debuginfo | 0:1.4.3-10.el7_2.1 |
| Red Hat Enterprise Linux 7 | libssh2-devel | 0:1.4.3-10.el7_2.1 |
| Red Hat Enterprise Linux 7 | libssh2-docs | 0:1.4.3-10.el7_2.1 |
| SUSE Linux Enterprise Desktop 11 SP4 | libssh2_org | 1.2.9-4.2.6.1 |
| SUSE Linux Enterprise Desktop 12 | libssh2_org | 1.4.3-16.1 |
| SUSE Linux Enterprise Desktop 12 SP1 | libssh2_org | 1.4.3-16.1 |
| SUSE Linux Enterprise Server 11 SP4 | libssh2_org | 1.2.9-4.2.6.1 |
| SUSE Linux Enterprise Server 12 | libssh2_org | 1.4.3-16.1 |
| SUSE Linux Enterprise Server 12 SP1 | libssh2_org | 1.4.3-16.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | libssh2_org | 1.2.9-4.2.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | libssh2_org | 1.4.3-16.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | libssh2_org | 1.4.3-16.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | libssh2_org | 1.2.9-4.2.6.1 |
| SUSE Linux Enterprise Software Development Kit 12 | libssh2_org | 1.4.3-16.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | libssh2_org | 1.4.3-16.1 |
| Ubuntu 14.04 LTS | libssh2 | 1.4.3-2ubuntu0.1 |
| Ubuntu 16.04 LTS | libssh2 | 1.5.0-2ubuntu0.1 |
| openSUSE Tumbleweed | libssh2_org | 1.7.0-1.5 |