ALAS-2016-683


Amazon Linux 1 Security Advisory: ALAS-2016-683
Advisory Release Date: 2016-04-06 14:40 Pacific
Advisory Updated Date: 2016-04-06 14:40 Pacific
Severity: Medium

Issue Overview:

A type confusion issue was found in the way libssh2 generated ephemeral secrets for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This would cause an SSHv2 Diffie-Hellman handshake to use significantly less secure random parameters.


Affected Packages:

libssh2


Issue Correction:
Run yum update libssh2 to update your system.

New Packages:
i686:
    libssh2-1.4.2-2.13.amzn1.i686
    libssh2-devel-1.4.2-2.13.amzn1.i686
    libssh2-debuginfo-1.4.2-2.13.amzn1.i686
    libssh2-docs-1.4.2-2.13.amzn1.i686

src:
    libssh2-1.4.2-2.13.amzn1.src

x86_64:
    libssh2-docs-1.4.2-2.13.amzn1.x86_64
    libssh2-1.4.2-2.13.amzn1.x86_64
    libssh2-devel-1.4.2-2.13.amzn1.x86_64
    libssh2-debuginfo-1.4.2-2.13.amzn1.x86_64