Alpine: multiple libssh packages: security update to 0.11.2-r0

high Tenable Cloud Security Plugin ID 427911

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the
ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values
where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return
a success status even when key derivation fails. This results in uninitialized cryptographic key buffers
being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity,
and availability. (CVE-2025-5372)

- There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large
input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can
experience an integer overflow leading to a memory under allocation, when that happens it's possible that
the program perform out of bounds write leading to a heap corruption. This issue affects only 32-bits
builds of libssh. (CVE-2025-4877)

- A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in
the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename
doesn't exist and may lead to possible signing failures or heap corruption. (CVE-2025-4878)

- A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be
triggered in the sftp_handle function due to an incorrect comparison check that permits the function to
access memory beyond the valid handle list and to return an invalid pointer, which is used in further
processing. This vulnerability allows an authenticated remote attacker to potentially read unintended
memory regions, exposing sensitive information or affect service behavior. (CVE-2025-5318)

- A flaw was found in the key export functionality of libssh. The issue occurs in the internal function
responsible for converting cryptographic keys into serialized formats. During error handling, a memory
structure is freed but not cleared, leading to a potential double free issue if an additional failure
occurs later in the function. This condition may result in heap corruption or application instability in
low-memory scenarios, posing a risk to system reliability where key export operations are performed.
(CVE-2025-5351)

Plugin Details

Severity: High

ID: 427911

Version: Revision 1.15

Type: Local

Family: Alpine Linux Local Security Checks

Published: 6/28/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

Percentile: 96.81

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-5372

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/24/2025

Reference Information

CVE: CVE-2025-4877, CVE-2025-4878, CVE-2025-5318, CVE-2025-5351, CVE-2025-5372, CVE-2025-5449, CVE-2025-5987

IAVA: 2025-A-0462-S

Detections

Analytics