NULL pointer dereference in Libssh
CVE-2020-1730
A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.031 (87.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 87.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.031 · newest: 0.031 · change: 0.000
Affected products
- Libssh
- NetApp Cloud Backup
- Oracle MySQL Workbench
- Canonical Ubuntu Linux — versions 18.04, 19.10
- Fedoraproject Fedora — versions 31, 32
- Red Hat Libssh — versions libssh versions before 0.8.9, libssh versions before 0.9.4
- Red Hat Enterprise Linux — versions 8.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- usn.ubuntu.com/4327-1/ (vendor-advisory, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- www.oracle.com/security-alerts/cpuoct2020.html (Patch, Third Party Advisory)
- www.libssh.org/security/advisories/CVE-2020-1730.txt (Vendor Advisory)
- bugzilla.redhat.com/show_bug.cgi (Third Party Advisory, Issue Tracking)
- security.netapp.com/advisory/ntap-20200424-0001/ (Third Party Advisory)
Frequently asked questions
- What is CVE-2020-1730?
- CVE-2020-1730 is a medium-severity vulnerability in Libssh, classified under NULL Pointer Dereference. CVSS score: 5.3/10. Published 2020-04-13.
- How severe is CVE-2020-1730?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2020-1730 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.