Description
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat Enterprise Linux 10
Default version status: affected
0:0.12.0-3.el10_2 to < *unaffected
Red Hat Red Hat Hardened Images
Default version status: affected
0.12.1-4.hum1 to < *unaffected
Red Hat Red Hat Enterprise Linux 8
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 9
Default version status: unaffected