PT-2026-26972 · Tinyssh · Tinyssh

Pythok · Publicado 2026-01-01 · Atualizado 2026-03-23 · CVE-2026-4541

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Baixa

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions janmojzis tinyssh versions up to 20250501

Description A flaw exists in the Ed25519 Signature Handler component of tinyssh, specifically within the tinyssh/crypto sign ed25519 tinyssh.c file. This issue causes improper verification of cryptographic signatures. The attack is limited to local execution and is considered difficult to exploit. The vulnerability resides in an unknown function.

Recommendations Upgrade to version 20260301 to address this issue.

Exploit

Correção

Insufficient Verification of Data Authenticity

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-345

CWE-347

Identificadores relacionados

CVE-2026-4541

Produtos afetados

Tinyssh

Referências · 23

• 🔥 https://github.com/janmojzis/tinyssh/issues/101#issue-3983586116 · Exploit
• https://github.com/janmojzis/tinyssh/issues/101 · Nota
• https://github.com/janmojzis/tinyssh/releases/tag/20260301 · Correção
• https://github.com/janmojzis/tinyssh/commit/9c87269607e0d7d20174df742accc49c042cff17 · Correção
• https://github.com/janmojzis/tinyssh/pull/102 · Correção
• https://vuldb.com/vuln/352358 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-4541 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-4541 · Nota de Segurança
• https://twitter.com/CVEarity/status/2035714440465981536 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2035992544119578852 · Publicação no Twitter
• https://security-tracker.debian.org/tracker/CVE-2026-4541 · Aviso do Fabricante
• https://vuldb.com/?id.352358 · Nota
• https://twitter.com/infoflowcloud/status/2035993929217147160 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2026-4541 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2035686575305105776 · Publicação no Twitter