« List of all CVEs

CVE-2025-5372

Libssh: incorrect return code handling in ssh_kdf() in libssh

Published: 7/4/2025 Last updated: 12/19/2025 Reserved: 5/30/2025

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.

CNA assigner: redhat (53f830b8-0a3f-465b-8143-3b8a9948e749) Requested by: n/a

Metrics

Version Score Severity Vector String
3.1 5 Medium CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Opam packages affected (1)

libssh

Products affected (17)

Product Vendor Version
Red Hat Enterprise Linux 8 Red Hat < 10.0.22621.1574
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Red Hat 7.0
Red Hat Enterprise Linux 10 Red Hat Snapdragon 7c Compute Platform (SC7180-AC)
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Red Hat < 5.16.5
Red Hat Enterprise Linux 10 Red Hat 7.2.0
libssh libssh 10.19.0.0
Red Hat Enterprise Linux 8 Red Hat n/a
Red Hat Enterprise Linux 9 Red Hat <= 7.0.10
Red Hat Enterprise Linux 8 Red Hat < 1.0.0
libssh libssh 6.0.6.1
Red Hat Enterprise Linux 8 Red Hat Snapdragon 782G Mobile Platform (SM7325-AF)
Red Hat Enterprise Linux 6 Red Hat 7.0.1
Red Hat Enterprise Linux 6 Red Hat < 10.0.14393.5192
Red Hat Enterprise Linux 7 Red Hat n/a
Red Hat Enterprise Linux 7 Red Hat Snapdragon 7c Gen 2 Compute Platform (SC7180-AD) "Rennell Pro"
Red Hat OpenShift Container Platform 4 Red Hat n/a
Red Hat OpenShift Container Platform 4 Red Hat < publication

References (8)