CVE-2023-6918 json
Libssh: missing checks for return values for digests
published 2023-12-18 2 y ago modified 2026-11-06 2 d ago also EUVD-2023-59117
- cvss
- 3.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 72%
- public exploits
- 0
- none known
Summary
A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.
Patch / fix
- Red Hat Red Hat Enterprise Linux 8 0:0.9.6-14.el8
- Red Hat Red Hat Enterprise Linux 9 0:0.10.4-13.el9
- libssh Debian 12 0.10.6-0+deb12u1
- libssh Debian 14, Debian 13 0.10.6-1
debian advisories DEBIAN-CVE-2023-6918
- libssh Ubuntu 20.04 LTS 0.9.3-2ubuntu2.5
- libssh Ubuntu 22.04 LTS 0.9.6-2ubuntu0.22.04.3
- libssh Ubuntu Pro 16.04 LTS 0.6.3-4.3ubuntu0.6+esm1
- libssh Ubuntu Pro 18.04 LTS 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm3
ubuntu advisories UBUNTU-CVE-2023-6918
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- libssh RHEL 8 0.9.6-14.el8
- libssh-config RHEL 8 0.9.6-14.el8
- libssh RHEL 9 0.10.4-13.el9
- libssh-config RHEL 9 0.10.4-13.el9
red hat advisories RHSA-2024:3233RHSA-2024:2504
- libssh SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 0.9.8-3.12.2
- libssh SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +6 more 0.9.8-150200.13.3.1
- libssh SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Real Time 15 SP4 +11 more 0.9.8-150400.3.3.1
suse advisories SUSE-SU-2024:0539-1SUSE-SU-2024:0525-1SUSE-SU-2024:0140-1
- libssh openSUSE Tumbleweed 0.10.6-1.1
opensuse advisories openSUSE-SU-2024:13638-1
- libssh AlmaLinux 8 0.9.6-14.el8
- libssh-config AlmaLinux 8 0.9.6-14.el8
- libssh AlmaLinux 9 0.10.4-13.el9
- libssh-config AlmaLinux 9 0.10.4-13.el9
almalinux advisories ALSA-2024:3233ALSA-2024:2504
- libssh Rocky Linux 9 0.10.4-13.el9
- libssh Rocky Linux 8 0.9.6-14.el8
rocky linux advisories RLSA-2024:2504RLSA-2024:3233
- libssh Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 0.10.6-r0
alpine advisories ALPINE-CVE-2023-6918
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- libssh CBL-Mariner 2.0, Azure Linux 3.0 0.10.6-1
azure linux advisories AZL-32199AZL-34943
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-6918 updated cvss 3.7
libssh: Missing checks for return values for digests
-
Red Hat Enterprise Linux 6 libssh2 Red Hat Enterprise Linux 7 libssh, libssh2affected: workaround, no fix planned “Out of support scope”
-
Red Hat Enterprise Linux AppStream (v. 8) libssh-devel 0.9.6-14.el8, libssh-debuginfo 0.9.6-14.el8, libssh-debugsource 0.9.6-14.el8fixed: vendor fix RHSA-2024:3233
-
Red Hat Enterprise Linux AppStream (v. 9) libssh-devel 0.10.4-13.el9, libssh-debuginfo 0.10.4-13.el9, libssh-debugsource 0.10.4-13.el9fixed: vendor fix RHSA-2024:2504
-
Red Hat Enterprise Linux BaseOS (v. 8) libssh 0.9.6-14.el8, libssh-config 0.9.6-14.el8fixed: vendor fix RHSA-2024:3233
-
Red Hat Enterprise Linux BaseOS (v. 9) libssh 0.10.4-13.el9, libssh-config 0.10.4-13.el9fixed: vendor fix RHSA-2024:2504
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.41% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected products
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
Classification
- Weakness
-
- CWE-252 Unchecked Return Value
References
-
access.redhat.com
/errata/RHSA-2024:2504
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:3233
vendor-advisory
-
access.redhat.com
/security/cve/CVE-2023-6918
vdb-entry, mailing-list, vendor-advisory
-
libssh.org
/security/advisories/CVE-2023-6918.txt
vendor-advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=2254997
issue-tracking, third-party-advisory
-
libssh.org
/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/
release-notes
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/
- security.netapp.com /advisory/ntap-20250214-0009/
Sources
- CVE List CVE-2023-6918
- NVD CVE-2023-6918
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.