Description
A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | libssh | libssh versions before 0.8.9, libssh versions before 0.9.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libssh | 0.9.4-1 | — |
| Debian 13 | libssh | 0.9.4-1 | — |
| Debian 12 | libssh | 0.9.4-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libssh | 0.8.0~20170825.94fa1e38-1ubuntu0.6 | USN-4327-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | libssh +2 | 0.9.4-2.el8 | RHSA-2020:4545 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Hypervisor 4 | redhat-virtualization-host +1 | 4.4.3-20201116.0.el8_3 | RHSA-2020:5218 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | libssh | 0.9.4-2.el8 | RLSA-2020:4545 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | libssh | 0.9.8-150200.13.3.1 | SUSE-SU-2024:0525-1 |
| SLES 15 SP2 | libssh | 0.9.8-150200.13.3.1 | SUSE-SU-2024:0525-1 |
| SLES 15 SP1 | libssh | 0.8.7-10.12.1 | SUSE-SU-2020:0967-1 |
| SLES 12 SP5 | libssh | 0.8.7-3.9.1 | SUSE-SU-2024:0539-1, SUSE-SU-2020:0968-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | libssh | 0.9.8-150200.13.3.1 | SUSE-SU-2024:0525-1 |
| SLES for SAP 15 SP2 | libssh | 0.9.8-150200.13.3.1 | SUSE-SU-2024:0525-1 |
| SLES for SAP 12 SP5 | libssh | 0.8.7-3.9.1 | SUSE-SU-2024:0539-1, SUSE-SU-2020:0968-1 |
| SLE Micro 5.2 | libssh | 0.9.8-150200.13.3.1 | SUSE-SU-2024:0525-1 |
| SLE Micro 5.1 | libssh | 0.9.8-150200.13.3.1 | SUSE-SU-2024:0525-1 |
| SLE HPC 15 SP3 | libssh | 0.9.8-150200.13.3.1 | SUSE-SU-2024:0525-1 |
| SLE HPC 15 SP2 | libssh | 0.9.8-150200.13.3.1 | SUSE-SU-2024:0525-1 |
| SUSE Enterprise Storage 7.1 | libssh | 0.9.8-150200.13.3.1 | SUSE-SU-2024:0525-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libssh | 0.9.6-2.1 | openSUSE-SU-2024:11603-1 |
| openSUSE Leap 15.1 | libssh | 0.8.7-lp151.2.12.1 | openSUSE-SU-2020:0510-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libssh | 0.9.4-r0 | — |
| Alpine v3.23 | libssh | 0.9.4-r0 | — |
| Alpine v3.22 | libssh | 0.9.4-r0 | — |
| Alpine v3.21 | libssh | 0.9.4-r0 | — |
| Alpine v3.20 | libssh | 0.9.4-r0 | — |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | libssh | 0.9.4-r0 | — |
| Alpine v3.18 | libssh | 0.9.4-r0 | — |
| Alpine v3.17 | libssh | 0.9.4-r0 | — |
| Alpine v3.16 | libssh | 0.9.4-r0 | — |
| Alpine v3.15 | libssh | 0.9.4-r0 | — |
| Alpine v3.14 | libssh | 0.9.4-r0 | — |
| Alpine v3.13 | libssh | 0.9.4-r0 | — |
| Alpine v3.12 | libssh | 0.9.4-r0 | — |
| Alpine v3.11 | libssh | 0.9.4-r0 | — |
| Alpine v3.10 | libssh | 0.8.9-r0 | — |
| Alpine v3.9 | libssh | 0.7.6-r3 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | libssh +2 | 0.9.4-2.el8 | ELSA-2020-4545 |
Advisories 15
- WID-SEC-2025-0227 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- RHSA-2020:4545 Red Hat Security Advisory: libssh security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-4327-1 libssh vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- RLSA-2020:4545 Moderate: libssh security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2024:0539-1 Security update for libssh SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11603-1 libssh-config-0.9.6-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0525-1 Security update for libssh SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0510-1 Security update for libssh SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0968-1 Security update for libssh SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0967-1 Security update for libssh SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0205 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 25, 2026
- RHSA-2020:5218 Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- WID-SEC-2024-3377 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2024-0439 libssh: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · May 7, 2024
- ELSA-2020-4545 Moderate: libssh security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 10, 2020
References
- FEDORA-2020-5a77f0d68f vendor-advisory
- USN-4327-1 vendor-advisory
- FEDORA-2020-6cad41abb0 vendor-advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.libssh.org/security/advisories/CVE-2020-1730.txt
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1730
- https://security.netapp.com/advisory/ntap-20200424-0001/