[ GLSA 201408-03 ] LibSSH: Information disclosure

[GLSA]

Gentoo Linux Security Advisory

Title: LibSSH: Information disclosure (GLSA 201408-03)
Severity: low
Exploitable: local
Date: August 10, 2014
Bug(s): #503504
ID: 201408-03

Synopsis

A vulnerability in LibSSH can result in leakage of private key
information.


Background

LibSSH is a C library providing SSHv2 and SSHv1.

Affected Packages

Package: net-libs/libssh
Vulnerable: < 0.6.3
Unaffected: >= 0.6.3
Architectures: All supported architectures


Description

A new connection inherits the state of the PRNG without re-seeding with
random data.


Impact

Servers using ECC (ECDSA) or DSA certificates in non-deterministic mode
may under certain conditions leak their private key.


Workaround

There is no known workaround at this time.

Resolution

All LibSSH users should upgrade to the latest version: