FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Client/server denial of service when handling AES-CTR ciphers

Affected packages
0.8.0 <= libssh < 0.8.9
0.9.0 <= libssh < 0.9.4

Details

VuXML ID 3d7dfd63-823b-11ea-b3a8-240a644dd835
Discovery 2020-01-25
Entry 2020-04-19

The libssh team reports (originally reported by Yasheng Yang from Google):

A malicious client or server could crash the counterpart implemented with libssh AES-CTR ciphers are used and don't get fully initialized. It will crash when it tries to cleanup the AES-CTR ciphers when closing the connection.

References

CVE Name CVE-2020-1730
URL https://www.libssh.org/security/advisories/CVE-2020-1730.txt"