Return of Wrong Status Code in libssh - CVE-2025-5987

Vulnerability identifier: #VU115172

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-5987

CWE-ID: CWE-393

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect handling of the wrong status code returned by the OpenSSL within the chacha20_poly1305_set_key() function when using the ChaCha20 cipher with the OpenSSL library. A remote attacker can force the library to partially initialize cipher context, leading to an undefined application's behavior.

libssh
Oracle Enterprise Communications Broker
Cloud Pak for Data System - Cyclops
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - AUS
Ubuntu
Anolis OS
openEuler
Fedora
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libssh (Ubuntu package)
libssh (Red Hat package)
libssh
libssh-debuginfo
libssh-debugsource
libssh-devel
libssh-help
libssh-config
libssh-doc
Red Hat OpenShift Container Platform
OpenShift Virtualization
Juniper Junos Space

Install updates from vendor's website.

libssh - update to 0.11.2
libssh (Ubuntu package) - addressed in versions 0.9.6-2ubuntu0.22.04.4, 0.10.6-2ubuntu0.1, 0.10.6-3ubuntu1.1, 0.11.1-1ubuntu0.1
libssh (Red Hat package) - addressed in versions 0.10.4-9.el9_2.2, 0.10.4-17.el9_7, 0.11.1-5.el10_1
libssh - update to 0.10.5-5
libssh-debuginfo - update to 0.10.5-5
libssh-debugsource - update to 0.10.5-5
libssh-devel - update to 0.10.5-5
libssh-help - update to 0.10.5-5
libssh - update to 0.10.5-8
libssh-devel - update to 0.10.5-8
libssh-config - update to 0.10.5-8
libssh-doc - update to 0.10.5-8
libssh - update to 0.11.2-1.fc41
Red Hat OpenShift Container Platform - addressed in versions 4.13.64, 4.14.61, 4.15.61, 4.16.56, 4.17.47, 4.18.32, 4.19.23, 4.20.12
OpenShift Virtualization - update to 4.19.17
Cloud Pak for Data System - Cyclops - update to 11.3.1.1
Juniper Junos Space - update to 26.1R1 Patch V1

• https://access.redhat.com/security/cve/CVE-2025-5987
• https://bugzilla.redhat.com/show_bug.cgi?id=2376219
• https://www.libssh.org/security/advisories/CVE-2025-5987.txt

• Security restrictions bypass in libssh
• Fedora 41 update for libssh
• openEuler 24.03 LTS SP1 update for libssh
• Anolis OS update for libssh
• Ubuntu update for libssh
• Red Hat Enterprise Linux 10 update for libssh
• Red Hat Enterprise Linux 9 update for libssh
• Red Hat Enterprise Linux 9 update for libssh
• Multiple vulnerabilities in Oracle Enterprise Communications Broker
• Multiple vulnerabilities in OpenShift Virtualization 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.20
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in IBM Cloud Pak for Data System - Cyclops
• Multiple vulnerabilities in Junos Space