FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Client/server denial of service when handling AES-CTR ciphers

Affected packages
0.8.0	<=	libssh	<	0.8.9
0.9.0	<=	libssh	<	0.9.4

Details

VuXML ID	3d7dfd63-823b-11ea-b3a8-240a644dd835
Discovery	2020-01-25
Entry	2020-04-19

The libssh team reports (originally reported by Yasheng Yang from Google):

A malicious client or server could crash the counterpart implemented with libssh AES-CTR ciphers are used and don't get fully initialized. It will crash when it tries to cleanup the AES-CTR ciphers when closing the connection.

[source]

References

CVE Name	CVE-2020-1730
URL	https://www.libssh.org/security/advisories/CVE-2020-1730.txt"