CVE-2025-5372

CWE-68211 documents10 sources
Severity
8.8HIGH
EPSS
0.1%
top 72.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Libssh LibsshRedhat Enterprise LinuxRedhat Openshift Container Platform
Timeline
PublishedJul 4
Latest updateApr 6

Description

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confide…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LExploitability: 1.6 | Impact: 3.4

Affected Packages3 packages

▶CVEListV5libssh/libssh< 0.11.2
▶NVDlibssh/libssh< 0.11.2
▶Debianlibssh< 0.9.8-0+deb11u2+3

Also affects: Enterprise Linux 10.0, 6.0, 7.0, 8.0, 9.0, Openshift Container Platform 4.0

🔴Vulnerability Details

3
GHSA
GHSA-59w5-j22f-h3rv: A flaw was found in libssh versions built with OpenSSL versions older than 3↗2025-07-04
▶
OSV
CVE-2025-5372: A flaw was found in libssh versions built with OpenSSL versions older than 3↗2025-07-04
▶
CVEList
Libssh: incorrect return code handling in ssh_kdf() in libssh↗2025-07-04
▶

📋Vendor Advisories

5
Oracle
Oracle Oracle Siebel CRM Risk Matrix: Containers and Related Services (libssh) — CVE-2025-5372↗2026-01-15
▶
Microsoft
Libssh: incorrect return code handling in ssh_kdf() in libssh↗2025-07-08
▶
Ubuntu
libssh vulnerabilities↗2025-07-07
▶
Red Hat
libssh: Incorrect Return Code Handling in ssh_kdf() in libssh↗2025-06-24
▶
Debian
CVE-2025-5372: libssh - A flaw was found in libssh versions built with OpenSSL versions older than 3.0, ...↗2025
▶

💬Community

2
Bugzilla
CVE-2025-5372 libssh2: Incorrect Return Code Handling in ssh_kdf() in libssh [epel-all]↗2026-04-06
▶
Bugzilla
CVE-2025-5372 libssh: Incorrect Return Code Handling in ssh_kdf() in libssh↗2025-05-30
▶