Public bug reported:
The diffie_hellman_sha256 and diffie_hellman_sha1 functions in kex.c in
libssh2 1.7.0 and prior improperly truncate secrets to 128 or 256 bits,
which makes it easier for man-in-the-middle attackers to decrypt or
intercept SSH sessions via unspecified vectors, aka a "bits/bytes
confusion bug."
** Affects: libssh2 (Ubuntu)
Importance: Undecided
Assignee: Brian Morton (rokclimb15)
Status: New
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2016-0787
** Changed in: libssh2 (Ubuntu)
Assignee: (unassigned) => Brian Morton (rokclimb15)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1664812
Title:
CVE-2016-0787
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libssh2/+bug/1664812/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
