Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2023-2283 Details

Description

A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
http://packetstormsecurity.com/files/172861/libssh-0.9.6-0.10.4-pki_verify_data_signature-Authorization-Bypass.html CVE
https://access.redhat.com/security/cve/CVE-2023-2283 CVEThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2189736 CVEIssue TrackingThird Party Advisory
http://seclists.org/fulldisclosure/2025/Feb/18 CVE
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27PD44ALQTZXX7K6JAM3BXBUHYA6DFFN/ CVE

see all 15 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-287Improper Authentication[email protected]
CWE-287Improper Authentication[email protected]

Affected Products

ProductVersions
libssh libssh
>= 0.9.1, <= 0.9.6
>= 0.10.0, <= 0.10.4

CPE

  • cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
fedoraproject fedora
37

CPE

  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
redhat enterprise linux
8.0
9.0

CPE

  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

10 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2023-2283
NVD Published Date:
May 26, 2023
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2023-2283 Details - Not Deferred