CVE-2014-0017
14.03.2014, 15:55
The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision.Enginsight
| Vendor | Product | Version |
|---|---|---|
| libssh | libssh | 𝑥 ≤ 0.6.2 |
| libssh | libssh | 0.4.7 |
| libssh | libssh | 0.4.8 |
| libssh | libssh | 0.5.0 |
| libssh | libssh | 0.5.0:rc1 |
| libssh | libssh | 0.5.1 |
| libssh | libssh | 0.5.2 |
| libssh | libssh | 0.5.3 |
| libssh | libssh | 0.5.4 |
| libssh | libssh | 0.5.5 |
| libssh | libssh | 0.6.0 |
| libssh | libssh | 0.6.1 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
References