CVE-2025-5372 - CVE House
Back to Database
Status published Medium CVE-2025-5372

Libssh: incorrect return code handling in ssh_kdf() in libssh

Vulnerability Description

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-5372

Credits & Attribution

No credits recorded in the NVD database.

References

More from libssh

View All →
CVE-2025-5351
Libssh: double free vulnerability in libssh key export functions
Medium 6.5
CVE-2020-16135
libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if...
Medium 5.9
CVE-2015-3146
The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c...
High 7.5
CVE-2014-8132
Double free vulnerability in the ssh_packet_kexinit function in kex.c in...
Medium 5
CVE-2014-0017
The RAND_bytes function in libssh before 0.6.3, when forking is...
Low 1.9

Affected Vendor

Affected Software

libssh, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4
Vulnerable Versions:
0, 0:0.9.6-16.el8_10, 0:0.9.4-2.el8_4.2, 0:0.9.6-4.el8_6.2, 0:0.9.6-13.el8_8.2, 0:0.9.6-3.el9_0.2

Timeline

Official Publish: July 4th, 2025
Last Modified: July 12th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-682

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.