Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-6918

Good to know:

icon

Date: December 18, 2023

A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.

Language: C

Severity Score

Related Resources (9)

https://access.redhat.com/security/cve/CVE-2023-6918
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/
https://bugzilla.redhat.com/show_bug.cgi?id=2254997
https://www.libssh.org/security/advisories/CVE-2023-6918.txt
https://nvd.nist.gov/vuln/detail/CVE-2023-6918
https://access.redhat.com/errata/RHSA-2024:2504
https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/
https://www.mend.io/vulnerability-database/CVE-2023-6918

Severity Score

Weakness Type (CWE)

Unchecked Return Value

CWE-252

Top Fix

icon

Upgrade Version

Upgrade to version libssh-0.9.8, libssh-0.10.6

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): LOW

Do you need more information?

Contact Us