CVE-2023-6918 — Unchecked Return Value in Libssh
Severity
5.3MEDIUMNVD
CNA3.7
EPSS
0.4%
top 41.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 19
Latest updateFeb 5
Description
A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4
Affected Packages2 packages
Also affects: Fedora 38, 39, Enterprise Linux 8.0, 9.0
🔴Vulnerability Details
5GHSA▶
GHSA-gpcj-wh2f-rr23: A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends↗2023-12-19
OSV▶
CVE-2023-6918: A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends↗2023-12-19
📋Vendor Advisories
5Debian▶
CVE-2023-6918: libssh - A flaw was found in the libssh implements abstract layer for message digest (MD)...↗2023