CVE-2022-29245

🗓️ 31 May 2022 16:35:11Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 93 Views

CVE-2022-29245: SSH.NET 2020.0.0 and 2020.0.1 generate private key using weak random number generator, patched in 2020.0.2

Reporter	Title	Published	Views	Family All 13
IBM Security Bulletins	Security Bulletin: IBM Robotic Process Automation is vulnerable to a man-in-the-middle due to ssh.net (CVE-2022-29245)	29 Jul 202216:01	–	ibm
Circl	CVE-2022-29245	31 May 202220:23	–	circl
CNNVD	SSH.NET 安全特征问题漏洞	31 May 202200:00	–	cnnvd
Cvelist	CVE-2022-29245 Weak private key generation in SSH.NET	31 May 202216:35	–	cvelist
EUVD	EUVD-2022-5968	3 Oct 202520:07	–	euvd
Github Security Blog	Weak private key generation in SSH.NET	1 Jun 202219:50	–	github
NVD	CVE-2022-29245	31 May 202217:15	–	nvd
OSV	CVE-2022-29245 Weak private key generation in SSH.NET	31 May 202216:35	–	osv
OSV	GHSA-72P8-V4HG-V45P Weak private key generation in SSH.NET	1 Jun 202219:50	–	osv
Prion	Code injection	31 May 202217:15	–	prion

NVD

Vulners

Node

ssh.net_project ssh.netMatch2020.0.0-.net

ssh.net_project ssh.netMatch2020.0.0beta1.net

ssh.net_project ssh.netMatch2020.0.1.net

[
  {
    "product": "SSH.NET",
    "vendor": "sshnet",
    "versions": [
      {
        "status": "affected",
        "version": ">= 2020.0.0, < 2020.0.2"
      }
    ]
  }
]

Source	Link
github	www.github.com/sshnet/SSH.NET/commit/03c6d60736b8f7b42e44d6989a53f9b644a091fb
github	www.github.com/sshnet/SSH.NET/blob/bc99ada7da3f05f50d9379f2644941d91d5bf05a/src/Renci.SshNet/Security/KeyExchangeECCurve25519.cs
github	www.github.com/sshnet/SSH.NET/releases/tag/2020.0.2
github	www.github.com/sshnet/SSH.NET/security/advisories/GHSA-72p8-v4hg-v45p