Bug 2369388 (CVE-2025-5372) - CVE-2025-5372 libssh: Incorrect Return Code Handling in ssh_kdf() in libssh
Summary: CVE-2025-5372 libssh: Incorrect Return Code Handling in ssh_kdf() in libssh
Keywords:
Status: NEW
Alias: CVE-2025-5372
Deadline: 2025-06-24
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2376282 2376277 2376278 2376279 2376280 2376281
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-05-30 11:36 UTC by OSIDB Bzimport
Modified: 2025-07-04 06:02 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-05-30 11:36:30 UTC
Incorrect Success Return vulnerability in the ssh_kdf() function of libssh when built with OpenSSL versions prior to 3.0. This issue arises because libssh interprets OpenSSL's return value 0 (indicating failure) as SSH_OK (indicating success). As a result, on failure, the function may return success without initializing the output key buffers. This can lead to the use of uninitialized cryptographic keys, affecting the encryption and decryption of SSH traffic. The vulnerability allows an attacker to exploit improper key handling, potentially resulting in data leakage, integrity issues, or denial of service during SSH communication.


Note You need to log in before you can comment on or make changes to this bug.