## Description libssh versions 0.6 and above have an authentication bypass vulnerability in the server code. By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication, the attacker could successfully authenticate without any credentials. ## Patch Availability Patches addressing the issue have been posted to: https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/ libssh version 0.8.4 and libssh 0.7.6 have been released to address this issue. ## Workaround There is no workaround for this issue. ## Credit The bug was discovered by Peter Winter-Smith of NCC Group. Patches are provided by the Anderson Toshiyuki Sasaki of Red Hat and the libssh team.

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.