Public bug reported: The diffie_hellman_sha256 and diffie_hellman_sha1 functions in kex.c in libssh2 1.7.0 and prior improperly truncate secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."
** Affects: libssh2 (Ubuntu) Importance: Undecided Assignee: Brian Morton (rokclimb15) Status: New ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2016-0787 ** Changed in: libssh2 (Ubuntu) Assignee: (unassigned) => Brian Morton (rokclimb15) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1664812 Title: CVE-2016-0787 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/libssh2/+bug/1664812/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs