SB2014030515 - Fedora EPEL 5 update for libssh
Published: March 5, 2014 Updated: April 24, 2025
Security Bulletin ID
SB2014030515
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Cryptographic issues (CVE-ID: CVE-2014-0017)
The vulnerability allows a local non-authenticated attacker to gain access to sensitive information.
The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision.
Remediation
Install update from vendor's website.