From 48f0bfc70363ca31c8889ca68759e587bc6d7cbd Mon Sep 17 00:00:00 2001 From: Aris Adamantiadis Date: Wed, 5 Feb 2014 21:24:12 +0100 Subject: security: fix for vulnerability CVE-2014-0017 When accepting a new connection, a forking server based on libssh forks and the child process handles the request. The RAND_bytes() function of openssl doesn't reset its state after the fork, but simply adds the current process id (getpid) to the PRNG state, which is not guaranteed to be unique. This can cause several children to end up with same PRNG state which is a security issue. Conflicts: src/bind.c --- include/libssh/wrapper.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include/libssh/wrapper.h') diff --git a/include/libssh/wrapper.h b/include/libssh/wrapper.h index 8c034970..b8cd4d27 100644 --- a/include/libssh/wrapper.h +++ b/include/libssh/wrapper.h @@ -44,5 +44,6 @@ int crypt_set_algorithms_server(ssh_session session); struct ssh_crypto_struct *crypto_new(void); void crypto_free(struct ssh_crypto_struct *crypto); +void ssh_reseed(void); #endif /* WRAPPER_H_ */ -- cgit