{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/libssh--0.10.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":4.8,"id":"CVE-2023-6004"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["libssh (\u003c 0.10.6)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["libssh"],"content_html":"\u003cp\u003eThe vulnerability, identified as CVE-2023-6004, affects the libssh library. It arises from the improper handling of SSH agent forwarding requests within the implementation. An attacker who has already achieved an authenticated session can exploit this flaw to induce the server to disclose sensitive information that would otherwise be protected by the protocol's expected boundaries. This issue affects versions of libssh prior to 0.10.6. Organizations relying on libssh for remote management or secure communication should prioritize updating to the latest secure version to mitigate the risk of unauthorized information access.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an authenticated attacker to access sensitive information from the memory space or communication channel associated with the affected session. While this requires prior authentication, it poses a risk to environments where multiple users or processes might interact with shared SSH agent instances, potentially leading to unauthorized data exfiltration or access to secondary services protected by those agents.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the libssh library to version 0.10.6 or later across all internal applications and dependent infrastructure. Ensure that all downstream software distributions consuming libssh as a dependency are rebuilt and updated to incorporate the patched version.\u003c/p\u003e\n","date_modified":"2026-10-14T16:28:07Z","date_published":"2026-10-14T16:28:07Z","id":"https://feed.craftedsignal.io/briefs/2026-10-libssh-info-disclosure/","summary":"A vulnerability in libssh (CVE-2023-6004) allows a remote, authenticated attacker to disclose sensitive information due to improper handling of SSH agent forwarding requests.","title":"Information Disclosure Vulnerability in libssh","url":"https://feed.craftedsignal.io/briefs/2026-10-libssh-info-disclosure/"}],"language":"en","title":"CraftedSignal Threat Feed - Libssh (\u003c 0.10.6)","version":"https://jsonfeed.org/version/1.1"}