CVE-2016-0739

libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to…

published April 13, 2016

CVSS
—
EPSS
2%
Percentile
84.0
In the wild
Unconfirmed
What it is

libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to 128 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02431 · 84.0th percentile
Published
2016-04-13T17:00Z
EPSS history
Timeline
  • 13 APR 17:00Z
    libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to…
    cvelistv5