Description
A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected products
- Red Hat / libsshlibssh versions before 0.8.9 – libssh versions before 0.8.9
- Red Hat / libsshlibssh versions before 0.9.4 – libssh versions before 0.9.4
References
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLSWHBQ3EPKGTGLQNH554Z746BJ3C554/
- VENDOR_ADVISORYhttps://usn.ubuntu.com/4327-1/
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2A7BIFKUYIYKTY7FX4BEWVC2OHS5DPOU/
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2020.html
- VENDOR_ADVISORYhttps://www.libssh.org/security/advisories/CVE-2020-1730.txt
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1730
- MISChttps://security.netapp.com/advisory/ntap-20200424-0001/