CVE-2025-5987

Libssh: invalid return code for chacha20 poly1305 with openssl backend

View on CVE.org
Published Jul 7, 2025 CVSS 3.1 · 8.1 High EPSS 1.7% KEV · Not listed
Description
A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.

Remediation

Vendor Workaround

A workaround for this issue is to disable the chacha20-poly1305@openssh.com cipher in applications using libssh when libssh is compiled with the OpenSSL backend, so the vulnerable ChaCha20-Poly1305 initialization path is not used. Alternatively, upgrade to a version of libssh containing the fix; upstream has released libssh 0.11.2 to correct this defect, and administrators are advised to upgrade or apply the upstream patch as soon as possible.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-20227 A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.
Ubuntu USN Ubuntu USN USN-7619-1 libssh vulnerabilities
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8		 cpe:/a:redhat:enterprise_linux:8
cpe:/o:redhat:rhel_els:6
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4
Type Values Removed Values Added
CPEs cpe:/o:redhat:rhivos:1
Vendors & Products Redhat rhivos
Type Values Removed Values Added
First Time appeared Redhat rhivos
CPEs cpe:/o:redhat:rhivos:1
Vendors & Products Redhat rhivos
Type Values Removed Values Added
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.13::el9
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.15::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.19::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.18::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.14::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.16::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.20::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4 cpe:/a:redhat:openshift:4.17::el9
References
Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
Redhat rhel E4s
Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_e4s:9.2::appstream
cpe:/a:redhat:rhel_eus:9.4::appstream
cpe:/a:redhat:rhel_eus:9.6::appstream
cpe:/o:redhat:enterprise_linux_eus:10.0
cpe:/o:redhat:rhel_e4s:9.2::baseos
cpe:/o:redhat:rhel_eus:9.4::baseos
cpe:/o:redhat:rhel_eus:9.6::baseos
Vendors & Products Redhat enterprise Linux Eus
Redhat rhel E4s
Redhat rhel Eus
References
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L'}

 cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/o:redhat:enterprise_linux:9::baseos
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.1
References
Type Values Removed Values Added
CPEs cpe:2.3:a:libssh:libssh:-:*:*:*:*:*:*:* cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*
Type Values Removed Values Added
First Time appeared Libssh
Libssh libssh
CPEs cpe:2.3:a:libssh:libssh:-:*:*:*:*:*:*:*
Vendors & Products Libssh
Libssh libssh
Type Values Removed Values Added
Metrics epss

{'score': 0.00038}

 epss

{'score': 0.00043}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description No description is available for this CVE. A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.
Title libssh: Invalid return code for chacha20 poly1305 with OpenSSL backend Libssh: invalid return code for chacha20 poly1305 with openssl backend
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Type Values Removed Values Added
Description No description is available for this CVE.
Title libssh: Invalid return code for chacha20 poly1305 with OpenSSL backend
Weaknesses CWE-393
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.0, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L'}

threat_severity

Moderate
Earlier changes (21)
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 5, 2026, 4:32 PM
Reserved
Jun 10, 2025, 9:55 PM

View source JSON

Updated
Jul 7, 2025, 2:37 PM

JSON

Status
Modified
Published
Jul 7, 2025, 3:15 PM
Modified
Nov 5, 2026, 5:17 PM

View source JSON

Severity
Moderate
Public date
Apr 26, 2025, 12:00 AM

View source Bugzilla JSON

No data.