Detections
Analytics

EulerOS Virtualization 2.15.0 : libssh (EulerOS-SA-2026-4604)

medium Nessus Plugin ID 377453

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the libssh package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A path traversal vulnerability exists in libssh when processing paths received from SCP servers. Attackers can bypass security restrictions by crafting malicious path parameters to access or manipulate file system paths beyond the intended scope. This vulnerability stems from insufficient validation and sanitization of filename paths returned by SCP servers.(CVE-2026-0964)

 No description is available for this CVE.(CVE-2026-0968)

 A vulnerability was found in libssh (unknown version). It has been declared as problematic.The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.As an impact it is known to affect availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2026-0966)

 libssh can try to open any file during configuration parsing, when misconfigured or when local attacker can provide malicious configuration. This applies for all configuration loaded from default location, configuration provided through the `ssh_config_parse_file()` and `ssh_bind_config_parse_file()` functions as well as configuration files included from them directly or through glob wildcards. The possibly dangerous files involve block devices, fifo, named pipe or huge system files that could cause Denial of Service. The solution here is allowing to read only regular files and enforcing configuration file size limit of 16MB. Currently, maximum line length of a configuration file is 1K so this will effectively mean configuration files of 16K lines should still keep working.(CVE-2026-0965)

 The function `match_pattern()` is used to match conditionals in client configuration files or known hosts against the hostname the client is connecting to. When the configuration file or known_hosts file is controlled by the attacker, connecting to specific hostnames could cause timeouts and resource exhaustion due to the ineffective backtracking of complex regular expressions. The pattern matching was modified to avoid the needless backtracing.(CVE-2026-0967)

 A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.(CVE-2026-3731)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libssh packages.

See Also

http://www.nessus.org/u?927d6e81

Plugin Details

Severity: Medium

ID: 377453

File Name: EulerOS_SA-2026-4604.nasl

Version: 1.1

Type: Local

Published: 11/7/2026

Updated: 11/7/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 52.02

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-3731

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-0966

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:huawei:euleros:uvp:2.15.0, p-cpe:/a:huawei:euleros:libssh

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/uvp_version

Exploit Ease: No known exploits are available

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 2/19/2026

Reference Information

CVE: CVE-2026-0964, CVE-2026-0965, CVE-2026-0966, CVE-2026-0967, CVE-2026-0968, CVE-2026-3731

IAVA: 2026-A-0166-S