NULL pointer dereference in Libssh
CVE-2020-1730
A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.
EPSS: 0.031 (86.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Libssh
- Netapp Cloud_backup
- Oracle Mysql_workbench
- Canonical Ubuntu_linux — versions 18.04, 19.10
- Fedoraproject Fedora — versions 31, 32
- Red Hat Libssh — versions libssh versions before 0.8.9, libssh versions before 0.9.4
- Redhat Enterprise_linux — versions 8.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (vendor-advisory)
- secalert@redhat.com (vendor-advisory, Third Party Advisory)
- secalert@redhat.com (vendor-advisory)
- secalert@redhat.com (Patch, Third Party Advisory)
- secalert@redhat.com (Vendor Advisory)
- secalert@redhat.com (Third Party Advisory, Issue Tracking)
- secalert@redhat.com (Third Party Advisory)
Frequently asked questions
- What is CVE-2020-1730?
- CVE-2020-1730 is a medium-severity vulnerability in Libssh, classified under NULL Pointer Dereference. CVSS score: 5.3/10. Published 2020-04-13.
- How severe is CVE-2020-1730?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2020-1730 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.