1

Running Ubuntu 16.04 - After hearing about the security issue with libssh I am trying to upgrade the package.

https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/

It appears I am running libssh 0.6.3-4.3?

dpkg -l | grep libssh
ii  libssh-gcrypt-4:amd64                 0.6.3-4.3                                  amd64        tiny C SSH library (gcrypt flavor)

Since I cannot do a simple apt update & apt upgrade as it will break some of my software, I installed the security updates only by using

apt-get -s dist-upgrade | grep "^Inst" | grep -i securi | awk -F " " {'print $2'} | xargs apt-get install

found here.

That appears to have cleared out my security updates pending list - However my libssh is still the same version after rebooting.

Is it possible the update hasn't been pushed yet?

Thanks for reading!

Improve this question
2
  • Doing distribution upgrades (i.e. going from 16.04 to 16.10) can pose potential issues from time to time. Upgrading your system is ALWAYS a good idea. It also makes issues like this less problematic. You're convoluting a very simple procedure which can be easily remedied by enabling backport repos in software & updates. all you have to do is sudo apt update; sudo apt upgrade; and then hit y for yes or n for no. typically the front end works fine unless youre running a server which isn't specified here.
    – user383919
    Oct 16, 2018 at 22:51
  • There is no way to easily upgrade libs on Ubuntu. You should get a security update of version 0.6.3-4.3 when it is ready.
    – mikewhatever
    Oct 16, 2018 at 22:54

2 Answers 2

Reset to default
3

The Ubuntu Security Team maintains a database of CVEs and their patches.

You can see for yourself if the patch for a particular CVE has been pushed: https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-10933.html

Ubuntu's Debian (not Snap) repositories use a snapshot method. After release, most packages WON'T receive new upstream versions but WILL receive security patches and high-priority bugfixes. This may be different behavior than the upstream website leads you to believe.

Example: libssh 0.6.3-4.3 is in the Ubuntu 16.04 repos. Ubuntu WON'T update the package to 0.7.6. Ubuntu WILL patch the vuln, and update the package to (something like) '0.6.3-4.3Ubuntu0'

EDIT: I was close. They did update the version to 0.6.3-4.3ubuntu0.1

Snaps, of course, work differently.

Improve this answer
1
  • Thanks for the reply, I have now updated my libssh as it has now been released.
    – askef
    Oct 17, 2018 at 20:39
2

There is an update available:

libssh (0.6.3-4.3ubuntu0.1) xenial-security; urgency=medium

  • SECURITY UPDATE: authentication bypass vulnerability
    • debian/patches/CVE-2018-10933-*.patch: add upstream patches to correct the issue.
    • CVE-2018-10933
Improve this answer
1
  • Thanks for the reply - It seems I was maybe too quick and had to wait for the update to be released.
    – askef
    Oct 17, 2018 at 20:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .