CVE-2023-6918Unchecked Return Value in Libssh

Severity
5.3MEDIUMNVD
CNA3.7
EPSS
0.4%
top 41.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedDec 19
Latest updateFeb 5

Description

A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

NVDlibssh/libssh0.9.00.9.8+1
Debianlibssh/libssh< 0.9.8-0+deb11u1+3

Also affects: Fedora 38, 39, Enterprise Linux 8.0, 9.0

🔴Vulnerability Details

5
OSV
libssh vulnerabilities2024-02-05
OSV
libssh vulnerabilities2024-01-22
GHSA
GHSA-gpcj-wh2f-rr23: A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends2023-12-19
OSV
CVE-2023-6918: A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends2023-12-19
CVEList
Libssh: missing checks for return values for digests2023-12-18

📋Vendor Advisories

5
Ubuntu
libssh vulnerabilities2024-02-05
Ubuntu
libssh vulnerabilities2024-01-22
Red Hat
libssh: Missing checks for return values for digests2023-12-18
Microsoft
Libssh: missing checks for return values for digests2023-12-12
Debian
CVE-2023-6918: libssh - A flaw was found in the libssh implements abstract layer for message digest (MD)...2023
CVE-2023-6918 — Unchecked Return Value in Libssh | cvebase