QwikSec

Security Database

CVE

CWE

Training

CVE-2020-1730

Published: Apr 13, 2020

Modified: Aug 4, 2024

PUBLISHED

CVSS v3.1

5.3

MEDIUM

Description

A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.

Vendor	Product	Versions
Red Hat	libssh	affected `libssh versions before 0.8.9` affected `libssh versions before 0.9.4`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

References

FEDORA-2020-5a77f0d68f

vendor-advisory

vendor-advisory

FEDORA-2020-6cad41abb0

vendor-advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

https://www.libssh.org/security/advisories/CVE-2020-1730.txt

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1730

https://security.netapp.com/advisory/ntap-20200424-0001/

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.