A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasnt been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libssh | Libssh | 0.8.0 (including) | 0.8.9 (excluding) |
| Libssh | Libssh | 0.9.0 (including) | 0.9.4 (excluding) |
| Red Hat Enterprise Linux 8 | RedHat | libssh-0:0.9.4-2.el8 | * |
| Red Hat Enterprise Linux 8 | RedHat | libssh-0:0.9.4-2.el8 | * |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 | RedHat | redhat-virtualization-host-0:4.4.3-20201116.0.el8_3 | * |
| Libssh | Ubuntu | bionic | * |
| Libssh | Ubuntu | devel | * |
| Libssh | Ubuntu | eoan | * |
| Libssh | Ubuntu | esm-infra/bionic | * |
| Libssh | Ubuntu | trusty | * |
| Libssh | Ubuntu | upstream | * |
Potential Mitigations
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1730
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2A7BIFKUYIYKTY7FX4BEWVC2OHS5DPOU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLSWHBQ3EPKGTGLQNH554Z746BJ3C554/
- https://security.netapp.com/advisory/ntap-20200424-0001/
- https://usn.ubuntu.com/4327-1/
- https://www.libssh.org/security/advisories/CVE-2020-1730.txt
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1730
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2A7BIFKUYIYKTY7FX4BEWVC2OHS5DPOU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLSWHBQ3EPKGTGLQNH554Z746BJ3C554/
- https://security.netapp.com/advisory/ntap-20200424-0001/
- https://usn.ubuntu.com/4327-1/
- https://www.libssh.org/security/advisories/CVE-2020-1730.txt
- https://www.oracle.com/security-alerts/cpuoct2020.html