CVE-2023-6918

CVE Details

Release Date:	2023-12-18
Impact:	Low	What is this?

Description

A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.

See more information about CVE-2023-6918 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	3.7
Vector String:	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Version:	3.0
Attack Vector:	Network
Attack Complexity:	High
Privileges Required:	None
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	None
Integrity Impact:	None
Availability Impact:	Low

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (libssh)	ELSA-2024-3233	2024-05-23
Oracle Linux version 9 (libssh)	ELSA-2024-2504	2024-05-02