A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasnt been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libssh | Libssh | 0.8.0 (including) | 0.8.9 (excluding) |
| Libssh | Libssh | 0.9.0 (including) | 0.9.4 (excluding) |
| Red Hat Enterprise Linux 8 | RedHat | libssh-0:0.9.4-2.el8 | * |
| Red Hat Enterprise Linux 8 | RedHat | libssh-0:0.9.4-2.el8 | * |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 | RedHat | redhat-virtualization-host-0:4.4.3-20201116.0.el8_3 | * |
| Libssh | Ubuntu | bionic | * |
| Libssh | Ubuntu | devel | * |
| Libssh | Ubuntu | eoan | * |
| Libssh | Ubuntu | trusty | * |
| Libssh | Ubuntu | upstream | * |