8.1

CVE-2025-5987

Libssh: invalid return code for chacha20 poly1305 with openssl backend

A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Libssh ≫ Libssh Version >= 0.10.0 < 0.11.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.44% 0.697
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
secalert@redhat.com 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-393 Return of Wrong Status Code

A function or operation returns an incorrect return value or status code that does not indicate the true result of execution, causing the product to modify its behavior based on the incorrect result.

https://access.redhat.com/security/cve/CVE-2025-5987
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2376219
Third Party Advisory
Issue Tracking
https://access.redhat.com/errata/RHSA-2025:23484
https://access.redhat.com/errata/RHSA-2025:23483
https://access.redhat.com/errata/RHSA-2026:0427
https://access.redhat.com/errata/RHSA-2026:0428
https://access.redhat.com/errata/RHSA-2026:0430
https://access.redhat.com/errata/RHSA-2026:0431
https://access.redhat.com/errata/RHSA-2026:0702
https://access.redhat.com/errata/RHSA-2026:0978
https://access.redhat.com/errata/RHSA-2026:0985
https://access.redhat.com/errata/RHSA-2026:0996
https://access.redhat.com/errata/RHSA-2026:0980
https://access.redhat.com/errata/RHSA-2026:1539
https://access.redhat.com/errata/RHSA-2026:1541
https://access.redhat.com/errata/RHSA-2026:3415
https://www.libssh.org/security/advisories/CVE-2025-5987.txt