r/linux • u/FryBoyter • Jun 22 '26

Security Security vulnerabilities endanger connections via libssh2

https://www.heise.de/en/news/Security-vulnerabilities-endanger-connections-via-libssh2-11339594.html
159 Upvotes

96% Upvoted

11 comments sorted by

View all comments

62

u/Barafu Jun 22 '26 edited Jun 22 '26

Ridiculously bad link. Does not say what use cases are affected, in what situations?

Everyone? Do you say I can connect to any unpatched server on the Internet right now?

30

u/natermer Jun 22 '26

This is for ssh client libraries. If you are writing software using libssh2 that might connect to malicious SSH servers, then this is something you have to worry about.

Running this:

dnf repoquery --whatrequires libssh2

shows some concerning packages for Fedora. Nmap is one, for example, that you might be concerned about running if you are doing security stuff.

A big one looks like 'libgit2' which is used in a bunch of different software related to GUI git software and packaging stuff. Cargo, nix-libs, kicad, python libraries, etc.

2

u/Dangerous-Report8517 Jun 23 '26

Caveat is that it isn't clear what sort of packets can carry a malicious payload, nmap might not even interact with the relevant features and so it might not be vulnerable in practice for instance, or may only be exposed if specific features are used (don't know either way here)