AZL-64656 CVE-2025-5372 affecting package libssh for versions less than 0.10.6-2

🗓️ 04 Jul 2025 06:15:24Reported by GoogleType

Libssh before 0.10.6-2 with OpenSSL below three causes misinterpreted KDF result leading to uninitialized keys and insecure secure shell sessions.

Reporter	Title	Published	Views	Family All 160
IBM Security Bulletins	Security Bulletin: Muliple security vulnerabilities found in IBM CICS TX Standard.	22 Apr 202614:23	–	ibm
IBM Security Bulletins	Security Bulletin: TSSC/IMC addresses multiple security vulnerabilities.	25 Feb 202617:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with Cloud Pak foundational services 4.17.0 shipped with IBM Cloud Pak for Business Automation iFixes for April 2026	27 May 202609:11	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in libssh library (CVE-2025-5372) affects Power HMC.	6 Apr 202606:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Financial Transaction Manager is impacted by multiple vulnerabilities in RedHat Proxy for Kubernetes RBAC authorization	9 Feb 202614:45	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities found in the Red Hat Universal Minimal Base Image shipped with CICS Transaction Gateway for Multiplatforms	26 Jan 202609:58	–	ibm
ATTACKERKB	CVE-2025-5372	4 Jul 202506:15	–	attackerkb
Tenable Nessus	Alibaba Cloud Linux 3 : 0189: libssh (ALINUX3-SA-2025:0189)	3 Dec 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : libssh (ALSA-2025:21977)	3 Dec 202500:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: libssh (CVE-2025-5372)	19 Jul 202500:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-5372

21 Apr 2026 04:32Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.15 - 8.8

EPSS0.00246

SSVC