UBUNTU-CVE-2025-5372

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2025-5372

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-5372.json

JSON Data

https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2025-5372

Upstream

CVE-2025-5372

Downstream

USN-7619-1

Related

USN-7619-1

Published

2025-06-25T00:00:00Z

Modified

2025-09-08T17:06:50Z

Severity

5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.

References

Affected packages

Ubuntu:22.04:LTS

libssh

Package

Name: libssh
Purl: pkg:deb/ubuntu/libssh@0.9.6-2ubuntu0.22.04.4?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.9.6-2ubuntu0.22.04.4

Affected versions

0.*

0.9.6-1

0.9.6-1build1

0.9.6-2

0.9.6-2build1

0.9.6-2ubuntu0.22.04.1

0.9.6-2ubuntu0.22.04.2

0.9.6-2ubuntu0.22.04.3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libssh-4",
            "binary_version": "0.9.6-2ubuntu0.22.04.4"
        },
        {
            "binary_name": "libssh-dev",
            "binary_version": "0.9.6-2ubuntu0.22.04.4"
        },
        {
            "binary_name": "libssh-gcrypt-4",
            "binary_version": "0.9.6-2ubuntu0.22.04.4"
        },
        {
            "binary_name": "libssh-gcrypt-dev",
            "binary_version": "0.9.6-2ubuntu0.22.04.4"
        }
    ],
    "availability": "No subscription required"
}

Ubuntu:24.04:LTS

libssh

Package

Name: libssh
Purl: pkg:deb/ubuntu/libssh@0.10.6-2ubuntu0.1?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.10.6-2ubuntu0.1

Affected versions

0.*

0.10.5-3ubuntu1

0.10.5-3ubuntu2

0.10.6-2

0.10.6-2build1

0.10.6-2build2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libssh-4",
            "binary_version": "0.10.6-2ubuntu0.1"
        },
        {
            "binary_name": "libssh-dev",
            "binary_version": "0.10.6-2ubuntu0.1"
        },
        {
            "binary_name": "libssh-gcrypt-4",
            "binary_version": "0.10.6-2ubuntu0.1"
        },
        {
            "binary_name": "libssh-gcrypt-dev",
            "binary_version": "0.10.6-2ubuntu0.1"
        }
    ],
    "availability": "No subscription required"
}

Ubuntu:25.04

libssh

Package

Name: libssh
Purl: pkg:deb/ubuntu/libssh@0.11.1-1ubuntu0.1?arch=source&distro=plucky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.11.1-1ubuntu0.1

Affected versions

0.*

0.10.6-3ubuntu1

0.11.1-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libssh-4",
            "binary_version": "0.11.1-1ubuntu0.1"
        },
        {
            "binary_name": "libssh-dev",
            "binary_version": "0.11.1-1ubuntu0.1"
        }
    ],
    "availability": "No subscription required"
}

Ubuntu:Pro:16.04:LTS

libssh

Package

Name: libssh
Purl: pkg:deb/ubuntu/libssh@0.6.3-4.3ubuntu0.6+esm2?arch=source&distro=esm-infra/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.6.3-3ubuntu3

0.6.3-4.1

0.6.3-4.2

0.6.3-4.2ubuntu1

0.6.3-4.3

0.6.3-4.3ubuntu0.1

0.6.3-4.3ubuntu0.2

0.6.3-4.3ubuntu0.5

0.6.3-4.3ubuntu0.6

0.6.3-4.3ubuntu0.6+esm1

0.6.3-4.3ubuntu0.6+esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libssh-4",
            "binary_version": "0.6.3-4.3ubuntu0.6+esm2"
        },
        {
            "binary_name": "libssh-dev",
            "binary_version": "0.6.3-4.3ubuntu0.6+esm2"
        },
        {
            "binary_name": "libssh-gcrypt-4",
            "binary_version": "0.6.3-4.3ubuntu0.6+esm2"
        },
        {
            "binary_name": "libssh-gcrypt-dev",
            "binary_version": "0.6.3-4.3ubuntu0.6+esm2"
        }
    ]
}

Ubuntu:Pro:18.04:LTS

libssh

Package

Name: libssh
Purl: pkg:deb/ubuntu/libssh@0.8.0~20170825.94fa1e38-1ubuntu0.7+esm4?arch=source&distro=esm-infra/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.7.5-1

0.8.0~20170825.94fa1e38-1

0.8.0~20170825.94fa1e38-1build1

0.8.0~20170825.94fa1e38-1ubuntu0.1

0.8.0~20170825.94fa1e38-1ubuntu0.2

0.8.0~20170825.94fa1e38-1ubuntu0.5

0.8.0~20170825.94fa1e38-1ubuntu0.6

0.8.0~20170825.94fa1e38-1ubuntu0.7

0.8.0~20170825.94fa1e38-1ubuntu0.7+esm3

0.8.0~20170825.94fa1e38-1ubuntu0.7+esm4

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libssh-4",
            "binary_version": "0.8.0~20170825.94fa1e38-1ubuntu0.7+esm4"
        },
        {
            "binary_name": "libssh-dev",
            "binary_version": "0.8.0~20170825.94fa1e38-1ubuntu0.7+esm4"
        },
        {
            "binary_name": "libssh-gcrypt-4",
            "binary_version": "0.8.0~20170825.94fa1e38-1ubuntu0.7+esm4"
        },
        {
            "binary_name": "libssh-gcrypt-dev",
            "binary_version": "0.8.0~20170825.94fa1e38-1ubuntu0.7+esm4"
        }
    ]
}

Ubuntu:Pro:20.04:LTS

libssh

Package

Name: libssh
Purl: pkg:deb/ubuntu/libssh@0.9.3-2ubuntu2.5+esm1?arch=source&distro=esm-infra/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.9.0-1ubuntu1

0.9.0-1ubuntu4

0.9.0-1ubuntu5

0.9.3-2ubuntu1

0.9.3-2ubuntu2

0.9.3-2ubuntu2.1

0.9.3-2ubuntu2.2

0.9.3-2ubuntu2.3

0.9.3-2ubuntu2.4

0.9.3-2ubuntu2.5

0.9.3-2ubuntu2.5+esm1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libssh-4",
            "binary_version": "0.9.3-2ubuntu2.5+esm1"
        },
        {
            "binary_name": "libssh-dev",
            "binary_version": "0.9.3-2ubuntu2.5+esm1"
        },
        {
            "binary_name": "libssh-gcrypt-4",
            "binary_version": "0.9.3-2ubuntu2.5+esm1"
        },
        {
            "binary_name": "libssh-gcrypt-dev",
            "binary_version": "0.9.3-2ubuntu2.5+esm1"
        }
    ]
}