CVE-2023-6918
Libssh: missing checks for return values for digests
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.
| CWE | CWE-252 |
| Vendor | red hat |
| Product | red hat enterprise linux 8 |
| Published | Dec 18, 2023 |
| Last Updated | Nov 21, 2025 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat enterprise linux 8
Be the first to know when new low vulnerabilities affecting red hat red hat enterprise linux 8 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected Versions
Red Hat / Red Hat Enterprise Linux 8
All versions affected Red Hat / Red Hat Enterprise Linux 8
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected Red Hat / Red Hat Enterprise Linux 6
All versions affected Red Hat / Red Hat Enterprise Linux 7
All versions affected Red Hat / Red Hat Enterprise Linux 7
All versions affected References
access.redhat.com: https://access.redhat.com/errata/RHSA-2024:2504 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:3233 access.redhat.com: https://access.redhat.com/security/cve/CVE-2023-6918 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2254997 libssh.org: https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/ libssh.org: https://www.libssh.org/security/advisories/CVE-2023-6918.txt lists.fedoraproject.org: https://lists.fedoraproject.org/archives/list/[email protected]/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/ lists.fedoraproject.org: https://lists.fedoraproject.org/archives/list/[email protected]/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/ security.netapp.com: https://security.netapp.com/advisory/ntap-20250214-0009/
Credits
Red Hat would like to thank Jack Weinstein (<[email protected]>) for reporting this issue.