Log in Start free

Vulnerability · Published Jul 29, 2020 · Assigned by mitre

CVE-2020-16135

Medium 5.9

In plain English

A medium-severity security flaw in the libssh-devel package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.1% (higher than 91% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.9Medium
Exploit odds (30 days)4.1%top 9.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libssh-devel0.9.4-3.el8ALSA-2021:4387
Alpine:v3.20libssh0.9.5-r0ALPINE-CVE-2020-16135
Alpine:v3.21libssh0.9.5-r0ALPINE-CVE-2020-16135
Alpine:v3.22libssh0.9.5-r0ALPINE-CVE-2020-16135
Alpine:v3.23libssh0.9.5-r0ALPINE-CVE-2020-16135
Alpine:v3.24libssh0.9.5-r0ALPINE-CVE-2020-16135
Debian:12libssh0.9.5-1DEBIAN-CVE-2020-16135
Debian:13libssh0.9.5-1DEBIAN-CVE-2020-16135
Debian:14libssh0.9.5-1DEBIAN-CVE-2020-16135
Rocky Linux:8libssh0:0.9.4-3.el8RLSA-2021:4387

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References