Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat LibSSH Library: Remote Code Execution Risk

published 10 months ago

Summary

A security update is available for the libssh library used by Red Hat systems. This update addresses a vulnerability that could allow an attacker to take control of a system remotely. Users should update their systems to the latest version of libssh to prevent potential exploitation.

What to do

Update redhat libssh to version 0:0.10.4-17.el9_7.
Update redhat libssh-config to version 0:0.10.4-17.el9_7.
Update redhat libssh-debuginfo to version 0:0.10.4-17.el9_7.
Update redhat libssh-debugsource to version 0:0.10.4-17.el9_7.
Update redhat libssh-devel to version 0:0.10.4-17.el9_7.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:9::appstream	redhat	libssh	< 0:0.10.4-17.el9_7 Fix: upgrade to 0:0.10.4-17.el9_7
Red Hat:enterprise_linux:9::appstream	redhat	libssh-config	< 0:0.10.4-17.el9_7 Fix: upgrade to 0:0.10.4-17.el9_7
Red Hat:enterprise_linux:9::appstream	redhat	libssh-debuginfo	< 0:0.10.4-17.el9_7 Fix: upgrade to 0:0.10.4-17.el9_7
Red Hat:enterprise_linux:9::appstream	redhat	libssh-debugsource	< 0:0.10.4-17.el9_7 Fix: upgrade to 0:0.10.4-17.el9_7
Red Hat:enterprise_linux:9::appstream	redhat	libssh-devel	< 0:0.10.4-17.el9_7 Fix: upgrade to 0:0.10.4-17.el9_7
Red Hat:enterprise_linux:9::baseos	redhat	libssh	< 0:0.10.4-17.el9_7 Fix: upgrade to 0:0.10.4-17.el9_7
Red Hat:enterprise_linux:9::baseos	redhat	libssh-config	< 0:0.10.4-17.el9_7 Fix: upgrade to 0:0.10.4-17.el9_7
Red Hat:enterprise_linux:9::baseos	redhat	libssh-debuginfo	< 0:0.10.4-17.el9_7 Fix: upgrade to 0:0.10.4-17.el9_7
Red Hat:enterprise_linux:9::baseos	redhat	libssh-debugsource	< 0:0.10.4-17.el9_7 Fix: upgrade to 0:0.10.4-17.el9_7
Red Hat:enterprise_linux:9::baseos	redhat	libssh-devel	< 0:0.10.4-17.el9_7 Fix: upgrade to 0:0.10.4-17.el9_7

Original advisory text

Red Hat Security Advisory: libssh security update

References

https://access.redhat.com/errata/RHSA-2025:23483 Vendor Advisory
https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2376219 Third Party Advisory
https://issues.redhat.com/browse/RHEL-135506 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23483.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-5987 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-5987 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-5987 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

8.1 High

Timeline

Published18 Dec 2025

Updated6 Mar 2026

First seen6 Mar 2026

Sources

RHSA-2025:23483 · OSV

Track software like this

Free during beta