Project libssh2 Security Advisory, February 23rd 2016 - Permalink
During the SSHv2 handshake when libssh2 is to get a suitable value for 'group order' in the Diffle Hellman negotiation, it would pass in number of bytes to a function that expected number of bits. This would result in the library generating numbers using only an 8th the number of random bits than what were intended: 128 or 256 bits instead of 1023 or 2047
Using such drastically reduced amount of random bits for Diffie Hellman weakended the handshake security significantly.
There are no known exploits of this flaw at this time.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2016-0787 to this issue.
libssh2 is used by many applications, but not always advertised as such!
libssh2 1.7.0 makes sure that there's a conversion done from number of bytes
to number of bits when the internal _libssh2_bn_rand function is called.
A patch for this problem is available at:
https://www.libssh2.org/CVE-2016-0787.patch
We suggest you take one of the following actions immediately, in order of preference:
A - Upgrade to libssh2 1.7.0
B - Apply the patch and rebuild libssh2
It was first reported to the libssh2 project on February 7 2016 by Andreas Schneider.
libssh2 1.7.0 was released on February 23rd 2016, coordinated with the publication of this advisory.
Reported by Andreas Schneider.
Thanks a lot!