{"action":"Upgrade libssh to 0.8.4-1 or later.","affected":[{"fixed":"0.8.4-1","introduced":"0"}],"component":"libssh","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["0.8.4-1"],"id":"tcs_01M5NCXCVCW4XEG8PH4JEX7ZDJ","modified_at":"2026-10-23T18:03:18.197210535Z","published_at":"2018-10-17T12:29:00.650Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2018-10933","https://security-tracker.debian.org/tracker/CVE-2018-10933"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2018-10933#Debian:13/libssh","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2018-10933"}],"summary":"A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthor"}