CVE-2018-10933

Name of the Vulnerable Software and Affected Versions libssh versions prior to 0.7.6 libssh versions prior to 0.8.4

Description A vulnerability was found in libssh's server-side state machine. It allows a malicious client to create channels without first performing authentication, resulting in unauthorized access. The issue is related to errors in the authentication procedure, which can be exploited by a remote attacker using a specially crafted message to bypass authentication.

Recommendations For versions prior to 0.7.6, update to version 0.7.6 or later. For versions prior to 0.8.4, update to version 0.8.4 or later.