This is an important SECURITY and maintenance release in order to address CVE-2014-0017 – PRNG state reuse on forking servers.
This bug happens when a SSH server forks on new connections. OpenSSL PRNG does not always detect the change of process (PID collision) and PRNG state may be shared between two successive children. However that bug is greatly mitigated by OpenSSL ECDSA signing code itself that reseeds the PRNG on every operation.
We advise that you upgrade or patch if you use libssh to build a forked SSH server.
If you are new to libssh read The Tutorial how to get started. Please join our mailing list or visit our IRC channel if you have questions.
You can download libssh 0.6.2 here.
ChangeLog
- CVE-2014-0017 – PRNG state reuse on forking servers