Log in Start free

Vulnerability · Published Apr 13, 2020 · Assigned by redhat

CVE-2020-1730

Medium 5.3

In plain English

A medium-severity null pointer dereference in libssh from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)3.1%top 12.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20libssh0.9.4-r0ALPINE-CVE-2020-1730
Alpine:v3.21libssh0.9.4-r0ALPINE-CVE-2020-1730
Alpine:v3.22libssh0.9.4-r0ALPINE-CVE-2020-1730
Alpine:v3.23libssh0.9.4-r0ALPINE-CVE-2020-1730
Alpine:v3.24libssh0.9.4-r0ALPINE-CVE-2020-1730
Debian:12libssh0.9.4-1DEBIAN-CVE-2020-1730
Debian:13libssh0.9.4-1DEBIAN-CVE-2020-1730
Debian:14libssh0.9.4-1DEBIAN-CVE-2020-1730
Rocky Linux:8libssh0:0.9.4-2.el8RLSA-2020:4545

Affected products (as reported)

VendorProductVersions
Red Hat libssh libssh versions before 0.8.9libssh versions before 0.9.4

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References