Security Update: libssh Vulnerability - Invalid Return Code in ChaCha20 Poly1305
Summary
ALSA-2025:23484: Moderate: libssh security update. Affects libssh versions < 0.11.1-5.el10_1. Fixed in 0.11.1-5.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libssh is a widely-used library that implements the SSH protocol, enabling secure communication between client and server applications. It is integral for secure data transfer and remote command execution. The library supports various cryptographic algorithms, including ChaCha20 and Poly1305, which are essential for maintaining data integrity and confidentiality. However, a recent vulnerability has been identified that affects its functionality, particularly when using the OpenSSL backend.
Vulnerability Detail
The vulnerability arises from an invalid return code in the ChaCha20 Poly1305 implementation when using the OpenSSL backend in libssh. This flaw could potentially allow an attacker to exploit the library, leading to unauthorized access or data manipulation. The issue is documented under CVE-2025-5987, which highlights the security implications and the need for immediate attention to prevent exploitation.
How To Fix
Minimum fixed version
0.11.1-5.el10_1
This is the first release that contains the fix.
sudo dnf update libsshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the security update as soon as it is available.
Conclusion
In summary, the libssh vulnerability identified as CVE-2025-5987 poses a moderate security risk due to an invalid return code in its ChaCha20 Poly1305 implementation. It is crucial for users to update their libssh packages to the patched version to mitigate potential risks. Regular monitoring and updates are essential for maintaining secure applications.
See every vulnerability recorded for libssh →
FAQ
libssh is a library that implements the SSH protocol, allowing secure communication between client and server applications.
CVE-2025-5987 refers to the specific vulnerability in libssh related to an invalid return code for the ChaCha20 Poly1305 implementation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring signup.
Failing to address this vulnerability could lead to unauthorized access and potential data breaches, compromising the security of applications using libssh.
Yes, there is a risk of data manipulation or unauthorized access, which could lead to data loss or corruption if the vulnerability is exploited.
Related vulnerabilities
Recent vulnerabilities recorded for libssh.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
