CVE-2020-16135
published 2020-07-29CVE-2020-16135: libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
PriorityP428medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
4.11%
89.7th percentile
libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | libssh | < libssh 0.9.5-1 (bookworm) | libssh 0.9.5-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| libssh | libssh | — | — |
| libssh | libssh | >= 0 < 0.9.5-1 | 0.9.5-1 |
| libssh | libssh | >= 0 < 0.9.5-1 | 0.9.5-1 |
| libssh | libssh | >= 0 < 0.9.5-1 | 0.9.5-1 |
| libssh | libssh | >= 0 < 0.9.5-1 | 0.9.5-1 |
| oracle | communications_cloud_native_core_policy | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_oracle5.9MEDIUM
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9j7p-fvvp-cp57: libssh 0
ghsa_unreviewed·2022-05-24
CVE-2020-16135 [HIGH] CWE-476 GHSA-9j7p-fvvp-cp57: libssh 0
libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
OSV
CVE-2020-16135: libssh 0
osv·2020-07-29·CVSS 5.9
CVE-2020-16135 [MEDIUM] CVE-2020-16135: libssh 0
libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
Oracle
Oracle Oracle Communications Risk Matrix: Policy (libssh) — CVE-2020-16135
vendor_oracle·2022-04-15·CVSS 5.9
CVE-2020-16135 [MEDIUM] Oracle Oracle Communications Risk Matrix: Policy (libssh) — CVE-2020-16135
Oracle Oracle Communications Risk Matrix: Policy (libssh) vulnerability
CVE: CVE-2020-16135
CVSS: 5.9
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
Ubuntu
libssh vulnerability
vendor_ubuntu·2020-08-04
CVE-2020-16135 libssh vulnerability
Title: libssh vulnerability
Summary: libssh could be made to crash if it received a specially crafted request.
It was discovered that libssh incorrectly handled certain requests.
An attacker could possibly use this issue to cause a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL
vendor_redhat·2020-07-30·CVSS 5.9
CVE-2020-16135 [MEDIUM] CWE-476 libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL
libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL
libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
A flaw was found in libssh. A NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
Statement: libssh2 as shipped with Red Hat Enterprise Linux 6, 7, and 8 are NOT affected by this flaw; libssh2 and libssh are different codebases and libssh2 does not contain the vulnerable code. Red Hat Product Security has set the impact of this flaw to Low because there is no demonstrated way for an attacker to reliably force a NULL pointer dereference via a code path in the affected libssh code.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red H
Debian
CVE-2020-16135: libssh - libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new re...
vendor_debian·2020·CVSS 5.9
CVE-2020-16135 [MEDIUM] CVE-2020-16135: libssh - libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new re...
libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
Scope: local
bookworm: resolved (fixed in 0.9.5-1)
bullseye: resolved (fixed in 0.9.5-1)
forky: resolved (fixed in 0.9.5-1)
sid: resolved (fixed in 0.9.5-1)
trixie: resolved (fixed in 0.9.5-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-16135 libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL
bugzilla·2020-07-31·CVSS 5.9
CVE-2020-16135 [MEDIUM] CVE-2020-16135 libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL
CVE-2020-16135 libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL
libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
External Reference:
https://bugs.gentoo.org/734624
Discussion:
Created libssh tracking bugs for this issue:
Affects: fedora-all [bug 1862457]
---
Flaw summary:
In sftp_get_client_message() of sftpserver.c, there is code msg->complete_message = ssh_buffer_new();. There is no check for msg->complete_message being NULL and it is immediately passed into ssh_buffer_add_data() and then buffer_verify(), which will cause a NULL pointer dereference in the case where ssh_buffer_new() returned NULL. ssh_buffer_new() could return NULL if either calloc() or ssh_buffer_allocate_size() (which in some cases calls
Bugzilla
CVE-2020-16135 libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL [fedora-all]
bugzilla·2020-07-31·CVSS 5.9
CVE-2020-16135 [MEDIUM] CVE-2020-16135 libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL [fedora-all]
CVE-2020-16135 libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affec
https://bugs.libssh.org/T232https://bugs.libssh.org/rLIBSSHe631ebb3e2247dd25e9678e6827c20dc73b73238https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120https://lists.debian.org/debian-lts-announce/2020/07/msg00034.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCIKQRKXAAB4HMWM62EPZJ4DVBHIIEG6/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JNW5GBC6JFN76VEWQXMLT5F7VCZ5AJ2E/https://security.gentoo.org/glsa/202011-05https://usn.ubuntu.com/4447-1/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://bugs.libssh.org/T232https://bugs.libssh.org/rLIBSSHe631ebb3e2247dd25e9678e6827c20dc73b73238https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120https://lists.debian.org/debian-lts-announce/2020/07/msg00034.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCIKQRKXAAB4HMWM62EPZJ4DVBHIIEG6/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JNW5GBC6JFN76VEWQXMLT5F7VCZ5AJ2E/https://security.gentoo.org/glsa/202011-05https://usn.ubuntu.com/4447-1/https://www.oracle.com/security-alerts/cpuapr2022.html
2020-07-29
Published