… is of course very very critical infrastructure, blunders in this area will have devastating consequences for the whole globe.

“Multiple security vulnerabilities were discovered in libssh2, a client-side C library implementing the SSH2 protocol which could result in memory disclosure, denial of service or potentially the execution of arbitrary code. For the stable distribution (trixie), these problems have been fixed in version 1.11.1-1+deb13u1.”

dpkg -l | grep libssh2
ii libssh2-1t64:arm64 1.11.1-1+deb13u1 arm64 SSH2 client-side library

 # find what's linked against it
sudo find / -type f -executable -exec sh -c 'ldd "$1" 2>/dev/null | grep -q libssh2 && echo "$1"' _ {} \;
/usr/bin/mocp <- kind of unecessary on most servers X-D
/usr/bin/curl
/usr/lib/git-core/git-http-fetch
/usr/lib/git-core/git-remote-http
/usr/lib/git-core/git-imap-send
/usr/lib/git-core/git-http-push
/usr/lib/gnupg1/gpgkeys_curl
/usr/lib/gnupg1/gpgkeys_hkp
  • so it would only be a problem when a user connects to a malicious ssh server. (crazy enough scenario, but not entirely impossible)

keeping everything up to date: server and client side

  • server and client: always do a full backup to external usb or other harddisk before any update (at best harddiskA is on the table, but not connected, harddiskB is in the fireproof metal vault somewhere else)
  • both server and client software (anything that exchanges data (a website is data, a email is data, a chat message is data) or messages with the outside world) needs to be kept as up to date as possible

yes apt and apt2 (?) says “no stable scripting” but daily nightly automatic updates (up to now) worked very well (highly critical military systems consider hourly updates) and are kind of unavoidable if the system is supposed to run latest security updates, run this on a nightly cronjob

but be aware that updates are just as secure as the update server and the verification process from “honest developer interested in doing more good than harm” -> repo -> programs and systems -> users.

if that is not an option:

  • guess the only possibility is blocking ssh access to the ssh port
  • or even tunneling ssh access? (making everything even more slow)
  • or shutdown and disable uninstalling ssh server

it’s a lot of work to deliver high quality software, creditz to all involved but plz keep up the effort 😀 how can the community the users support?

licence and M$ involvement?

why is it not GPL licenced? 🙁

/* Copyright (C) 2004-2007 Sara Golemon <sarag@libssh2.org>
 * Copyright (C) 2005,2006 Mikhail Gusarov <dottedmag@dottedmag.net>
 * Copyright (C) 2006-2007 The Written Word, Inc.
 * Copyright (C) 2007 Eli Fant <elifantu@mail.ru>
 * Copyright (C) 2009-2023 Daniel Stenberg
 * Copyright (C) 2008, 2009 Simon Josefsson
 * Copyright (C) 2000 Markus Friedl
 * Copyright (C) 2015 Microsoft Corp. <-whaaaaaat?
 * All rights reserved.
https://libssh2.org/license.html

Microsoft is included in the libssh2 copyright notices because the project incorporated code from Microsoft’s Win32 port of OpenSSH. GitHub

Specifically, the implementation in src/agent.c used the openssh-portable repository (associated with PowerShell) as a base for several components, including:

  • Windows-specific compatibility files (such as fileio.c and wmain_common.c). GitHub
  • The structure of specific functions used to connect and transact with the OpenSSH agent. GitHub
  • Windows equivalents for common Unix functions that were inlined into the implementation. GitHub

Because this code was integrated into the library to provide better Windows support, the original Microsoft copyright notice from 2015 is retained in the source code and overall license notices to comply with the redistribution terms.

 

liked this article?

  • only together we can create a truly free world
  • plz support dwaves to keep it up & running!
  • (yes the info on the internet is (mostly) free but beer is still not free (still have to work on that))
  • really really hate advertisement
  • contribute: whenever a solution was found, blog about it for others to find!
  • talk about, recommend & link to this blog and articles
  • thanks to all who contribute!
admin