CVE-2025-5372

Publication date 25 June 2025

Last updated 10 July 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

5.0 · Medium

Score breakdown

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.

Status

Package Ubuntu Release Status
libssh 25.04 plucky
Fixed 0.11.1-1ubuntu0.1
24.10 oracular
Fixed 0.10.6-3ubuntu1.1
24.04 LTS noble
Fixed 0.10.6-2ubuntu0.1
22.04 LTS jammy
Fixed 0.9.6-2ubuntu0.22.04.4
20.04 LTS focal Ignored changes too intrusive
18.04 LTS bionic Ignored changes too intrusive
16.04 LTS xenial Ignored changes too intrusive

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
libssh

Severity score breakdown

Parameter Value
Base score 5.0 · Medium
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality Low
Integrity impact Low
Availability impact Low
Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

References

Related Ubuntu Security Notices (USN)

Other references