Lucene search

RedhatCVE-2020-1730

HistoryApr 13, 2020 - 7:15 p.m.

CVE-2020-1730

2020-04-1319:15:11

CWE-476

redhat

web.nvd.nist.gov

293

cve-2020-1730

libssh

aes-ctr

des ciphers

vulnerability

system availability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

5.2

Confidence

High

EPSS

0.004

Percentile

74.3%

JSON

A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn’t been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.

Affected configurations

Nvd

Vulners

Node

libsshlibsshRange0.8.0–0.8.9

libsshlibsshRange0.9.0–0.9.4

Node

netappcloud_backupMatch-

canonicalubuntu_linuxMatch18.04lts

canonicalubuntu_linuxMatch19.10

fedoraprojectfedoraMatch31

fedoraprojectfedoraMatch32

redhatenterprise_linuxMatch8.0

Node

oraclemysql_workbenchRange≤8.0.21

VendorProductVersionCPE
libsshlibssh*cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*
netappcloud_backup-cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
canonicalubuntu_linux18.04cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
canonicalubuntu_linux19.10cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
fedoraprojectfedora31cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
fedoraprojectfedora32cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
redhatenterprise_linux8.0cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
oraclemysql_workbench*cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
libssh	libssh	*	cpe:2.3:a:libssh:libssh::::::::
netapp	cloud_backup	-	cpe:2.3:a:netapp:cloud_backup:-:::::::*
canonical	ubuntu_linux	18.04	cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
canonical	ubuntu_linux	19.10	cpe:2.3:o:canonical:ubuntu_linux:19.10:::::::*
fedoraproject	fedora	31	cpe:2.3:o:fedoraproject:fedora:31:::::::*
fedoraproject	fedora	32	cpe:2.3:o:fedoraproject:fedora:32:::::::*
redhat	enterprise_linux	8.0	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
oracle	mysql_workbench	*	cpe:2.3:a:oracle:mysql_workbench::::::::

CNA Affected

[
  {
    "vendor": "Red Hat",
    "product": "libssh",
    "versions": [
      {
        "version": "libssh versions before 0.8.9",
        "status": "affected"
      },
      {
        "version": "libssh versions before 0.9.4",
        "status": "affected"
      }
    ]
  }
]