Cyber Resilience

CVE-2023-6918

Low

Published: 19 December 2023

Published
19 December 2023
Modified
15 February 2025
KEV Added
—
Patch
—
CVSS Score v3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0036 58.8th percentile
Risk Priority 8 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-6918 is a low-severity Unchecked Return Value (CWE-252) vulnerability in Libssh Libssh. Its CVSS base score is 3.7 (Low).

Operationally, ranked in the top 41.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or…

more

usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.

CWE(s)
CWE-252

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

libssh
libssh
0.9.0 — 0.9.8 · 0.10.0 — 0.10.6
fedoraproject
fedora
38, 39
redhat
enterprise linux
8.0, 9.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References