CVE-2020-1730CWE-476

A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers

Medium · published April 13, 2020

CVSS v3.1
5.3
EPSS
3%
Percentile
87.8
In the wild
Unconfirmed
What it is

A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.03142 · 87.8th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2020-04-13T00:00Z
EPSS history
Timeline
  • 13 APR 00:00Z
    A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers
    cvelistv5