CVE-2025-5372
published 2025-07-04CVE-2025-5372: A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to…
high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libssh | < libssh 0.10.6-0+deb12u2 (bookworm) | libssh 0.10.6-0+deb12u2 (bookworm) |
| libssh | libssh | < 0.11.2 | 0.11.2 |
| libssh | libssh | >= 0 < 0.9.8-0+deb11u2 | 0.9.8-0+deb11u2 |
| libssh | libssh | >= 0 < 0.10.6-0+deb12u2 | 0.10.6-0+deb12u2 |
| libssh | libssh | >= 0 < 0.11.2-1 | 0.11.2-1 |
| libssh | libssh | >= 0 < 0.11.2-1 | 0.11.2-1 |
| libssh | libssh | >= 0 < 0.9.6-2ubuntu0.22.04.4 | 0.9.6-2ubuntu0.22.04.4 |
| libssh | libssh | >= 0 < 0.10.6-2ubuntu0.1 | 0.10.6-2ubuntu0.1 |
| msrc | azl3_libssh_0.10.6-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_libssh_0.10.6-2_on_azure_linux_3.0 | — | — |
| msrc | cbl2_libssh_0.10.6-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_libssh_0.10.6-2_on_cbl_mariner_2.0 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH