Moderate Vulnerability in libssh: Invalid Return Code for ChaCha20 Poly1305 with OpenSSL Backend
Summary
RLSA-2025:23483: Moderate: libssh security update. Affects libssh versions < 0:0.10.4-17.el9_7. Fixed in 0:0.10.4-17.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libssh is a widely used library that implements the SSH protocol, enabling secure communication between client and server applications. It is essential for various network services and applications that require secure data transmission. The library is designed to be lightweight and efficient, making it a popular choice among developers. However, it has been identified to have a security vulnerability that could potentially affect its functionality and the security of applications relying on it.
Vulnerability Detail
The vulnerability arises from an invalid return code in the ChaCha20 Poly1305 encryption implementation when using the OpenSSL backend. This flaw can lead to improper handling of encryption, which may allow attackers to exploit the situation, potentially compromising the confidentiality and integrity of the data being transmitted. The issue is documented under CVE-2025-5987, and it is crucial for users of libssh to address this vulnerability to safeguard their applications.
How To Fix
Minimum fixed version
0:0.10.4-17.el9_7
This is the first release that contains the fix.
sudo dnf update libsshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users may consider disabling the use of the ChaCha20 Poly1305 encryption method in their applications until the package can be updated. However, this is not a long-term solution and should only be used if absolutely necessary.
Conclusion
The identified vulnerability in libssh poses a moderate risk to applications utilizing this library for secure communication. It is imperative for users to update to the patched version to ensure the security and integrity of their applications. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for libssh →
FAQ
The CVSS score of this vulnerability is 5.0, indicating a moderate severity level.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Failing to address this vulnerability may lead to unauthorized access to sensitive data, compromising the security of your applications and potentially leading to data breaches.
Yes, the patched version of libssh is 0:0.10.4-17.el9_7. Updating to this version will mitigate the vulnerability.
If immediate updates are not possible, consider disabling the ChaCha20 Poly1305 encryption method as a temporary workaround until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for libssh.
