CVE-2023-6918
The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF.
Does this matter?
Lower severity and a low EPSS score (1.41%). Track it; it rarely justifies an emergency change on its own.
Description
A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- EPSS
- 1.41% probability · 71th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-252
- Affected
- libssh/libssh · fedoraproject/fedora · redhat/enterprise linux
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2024:2504
- https://access.redhat.com/errata/RHSA-2024:3233
- https://access.redhat.com/security/cve/CVE-2023-6918Mailing List, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2254997Issue Tracking, Third Party Advisory
- https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/Release Notes
- https://www.libssh.org/security/advisories/CVE-2023-6918.txtVendor Advisory
- https://access.redhat.com/errata/RHSA-2024:2504
- https://access.redhat.com/errata/RHSA-2024:3233
- https://access.redhat.com/security/cve/CVE-2023-6918Mailing List, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2254997Issue Tracking, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/
- https://security.netapp.com/advisory/ntap-20250214-0009/
- https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/Release Notes
- https://www.libssh.org/security/advisories/CVE-2023-6918.txtVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.