Skip to content
Fencer Intel
medium 5.9

CVE-2020-14145 json

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation.

published 6y ago modified 26d ago also EUVD-2020-6303 , JLSEC-2026-63

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.9%
EPSS 2.9% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

Patch / fix

  • julia OpenSSH_jll 9.1.0+0
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • openssh RHEL 8 8.0p1-10.el8
  • openssh-cavs RHEL 8 8.0p1-10.el8
  • openssh-ldap RHEL 8 8.0p1-10.el8
  • openssh-keycat RHEL 8 8.0p1-10.el8
  • openssh-server RHEL 8 8.0p1-10.el8
  • openssh-askpass RHEL 8 8.0p1-10.el8
  • openssh-clients RHEL 8 8.0p1-10.el8
  • pam_ssh_agent_auth RHEL 8 0.10.3-7.10.el8

red hat advisories RHSA-2021:4368

  • openssh SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES 12 SP3-LTSS +8 more 7.2p2-74.57.1
  • openssh-askpass-gnome SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES 12 SP3-LTSS +8 more 7.2p2-74.57.1
  • openssh SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 7.6p1-9.38.1
  • openssh SLE Module for Server Applications 15 SP1, SLE Module for Basesystem 15 SP1 7.9p1-6.22.1
  • openssh-askpass-gnome SLE Module for Desktop Applications 15 SP1 7.9p1-6.22.1
  • openssh SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +3 more 7.2p2-78.10.1
  • openssh-askpass-gnome SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +3 more 7.2p2-78.10.1
  • openssh SLE Module for Server Applications 15 SP2, SLE Module for Basesystem 15 SP2 8.1p1-5.9.1

suse advisories SUSE-SU-2021:0022-1SUSE-SU-2020:3882-1SUSE-SU-2020:3866-1SUSE-SU-2020:3844-1SUSE-SU-2020:3736-1

  • openssh openSUSE Leap 15.1 7.9p1-lp151.4.18.1
  • openssh-askpass-gnome openSUSE Leap 15.1 7.9p1-lp151.4.18.1
  • openssh openSUSE Leap 15.2 8.1p1-lp152.4.9.1
  • openssh-askpass-gnome openSUSE Leap 15.2 8.1p1-lp152.4.9.1

opensuse advisories openSUSE-SU-2020:2298-1openSUSE-SU-2020:2240-1

  • openssh-askpass AlmaLinux 8 8.0p1-10.el8

almalinux advisories ALSA-2021:4368

  • openssh Rocky Linux 8 8.0p1-10.el8

rocky linux advisories RLSA-2021:4368

  • openssh Alpine 3.12 8.3_p1-r1
  • openssh Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 8.4_p1-r0

alpine advisories ALPINE-CVE-2020-14145

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2020-14145 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-14145 updated cvss 5.9

openssh: Observable discrepancy leading to an information leak in the algorithm negotiation

  • Red Hat Enterprise Linux 5 openssh Red Hat Enterprise Linux 6 openssh, openssh-ldap, openssh-server, openssh-askpass, openssh-clients, pam_ssh_agent_auth Red Hat Enterprise Linux 7 openssh, openssh-cavs, openssh-ldap, openssh-keycat, openssh-server, openssh-askpass, +3 more
    affected: workaround, no fix planned “Always connect to SSH servers with verified host keys to avoid any possibilities of man-in-the-middle attack.”
  • Red Hat Enterprise Linux AppStream (v. 8) openssh-askpass 8.0p1-10.el8 Red Hat Enterprise Linux BaseOS (v. 8) openssh 8.0p1-10.el8, openssh-cavs 8.0p1-10.el8, openssh-ldap 8.0p1-10.el8, openssh-keycat 8.0p1-10.el8, openssh-server 8.0p1-10.el8, openssh-clients 8.0p1-10.el8, +1 more
    fixed: vendor fix “Always connect to SSH servers with verified host keys to avoid any possibilities of man-in-the-middle attack.” RHSA-2021:4368

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated cvss 5.9

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
10mo ago

Exploit prediction

2.95% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N
OSV 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
julia OpenSSH_jll
<9.1.0+0
9.1.0+0

Affected products

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.