CVE-2018-10933

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

Affected products

Alt Linux, Suse, Ubuntu, Libssh

Libssh

< 0.7.6, 0.8.4

Fix

Available

CVSS 3.0

9.1 CRITICAL

EPSS

91.8% (100th percentile)

Weakness

CWE-592, CWE-287

NVD status

Modified

Published

2018-10-17