Security Vulnerability in libssh: Invalid Return Code for ChaCha20 Poly1305
Summary
ALSA-2025:23483: Moderate: libssh security update. Affects libssh versions < 0.10.4-17.el9_7. Fixed in 0.10.4-17.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libssh is a widely used library that implements the SSH protocol, enabling secure communication between client and server applications. It is known for its flexibility and performance, supporting various cryptographic algorithms. However, a recent security issue has been identified that affects its functionality, specifically when using the OpenSSL backend with the ChaCha20 Poly1305 algorithm.
Vulnerability Detail
The vulnerability arises from an invalid return code in the libssh library when utilizing the ChaCha20 Poly1305 encryption method with the OpenSSL backend. This flaw could potentially lead to security breaches, as it may allow attackers to exploit the improper handling of encryption, compromising the confidentiality and integrity of data transmitted over SSH connections. The issue has been assigned CVE-2025-5987, highlighting its significance and the need for immediate attention.
How To Fix
Minimum fixed version
0.10.4-17.el9_7
This is the first release that contains the fix.
sudo dnf update libsshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider disabling the use of the ChaCha20 Poly1305 algorithm in their SSH configurations until the update can be applied. This can be done by modifying the SSH configuration files to exclude this encryption method.
Conclusion
The libssh library has a moderate security vulnerability related to the ChaCha20 Poly1305 encryption method. It is crucial for users to update to the latest patched version to mitigate potential risks. Temporary workarounds are available, but the best course of action is to apply the update as soon as possible.
See every vulnerability recorded for libssh →
FAQ
CVE-2025-5987 is the identifier assigned to the vulnerability in libssh that involves an invalid return code for the ChaCha20 Poly1305 encryption method.
This vulnerability can compromise the security of data transmitted over SSH connections, potentially allowing unauthorized access or data manipulation.
If an immediate update is not possible, consider disabling the ChaCha20 Poly1305 algorithm in your SSH configuration as a temporary workaround.
More details can be found on the CVE page for CVE-2025-5987, which provides insights into the impact and technical specifics of the vulnerability.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file. Check your application for vulnerabilities at the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for libssh.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
