Skip to content
Fencer Intel
medium 5.3

CVE-2020-1730 json

A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers.

published 6y ago modified 4mo ago also EUVD-2020-12576

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.1%
EPSS 3.1% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.

Patch / fix

  • libssh libssh 0.8.9, 0.9.4
  • libssh Debian 14, Debian 13, Debian 12 0.9.4-1

debian advisories DEBIAN-CVE-2020-1730

  • libssh Ubuntu 18.04 LTS 0.8.0~20170825.94fa1e38-1ubuntu0.6

ubuntu advisories UBUNTU-CVE-2020-1730

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • redhat-virtualization-host rhev hypervisor 4.4 4.4.3-20201116.0.el8_3
  • redhat-virtualization-host-image-update rhev hypervisor 4.4 4.4.3-20201116.0.el8_3
  • libssh RHEL 8 0.9.4-2.el8
  • libssh-config RHEL 8 0.9.4-2.el8

red hat advisories RHSA-2020:5218RHSA-2020:4545

  • libssh SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 0.9.8-3.12.2
  • libssh SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +6 more 0.9.8-150200.13.3.1
  • libssh SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 0.8.7-3.9.1
  • libssh SLE Module for Basesystem 15 SP1 0.8.7-10.12.1

suse advisories SUSE-SU-2024:0539-1SUSE-SU-2024:0525-1SUSE-SU-2020:0968-1SUSE-SU-2020:0967-1

  • libssh openSUSE Tumbleweed 0.9.6-2.1
  • libssh openSUSE Leap 15.1 0.8.7-lp151.2.12.1

opensuse advisories openSUSE-SU-2024:11603-1openSUSE-SU-2020:0510-1

  • libssh Rocky Linux 8 0.9.4-2.el8

rocky linux advisories RLSA-2020:4545

  • libssh Alpine 3.10 0.8.9-r0
  • libssh Alpine 3.24, Alpine 3.23, Alpine 3.22 +11 more 0.9.4-r0
  • libssh Alpine 3.9 0.7.6-r3

alpine advisories ALPINE-CVE-2020-1730

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libssh Arch Linux 0.9.4-1

arch linux advisories AVG-1130

Is CVE-2020-1730 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-1730 updated cvss 5.3

libssh: denial of service when handling AES-CTR (or DES) ciphers

  • Red Hat Enterprise Linux AppStream (v. 8) libssh-devel 0.9.4-2.el8, libssh-debuginfo 0.9.4-2.el8, libssh-debugsource 0.9.4-2.el8 Red Hat Enterprise Linux BaseOS (v. 8) libssh 0.9.4-2.el8, libssh-config 0.9.4-2.el8
    fixed: vendor fix RHSA-2020:4545
  • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host 4.4.3-20201116.0.el8_3, redhat-virtualization-host-image-update 4.4.3-20201116.0.el8_3
    fixed: vendor fix RHSA-2020:5218
  • Red Hat Enterprise Linux 6 libssh2 Red Hat Enterprise Linux 7 libssh, libssh2 Red Hat Enterprise Linux 8 libssh2 Red Hat RHEL 8-based RHEV-H for RHEV 4 (build requirements) imgbased 1.2.13-0.1.el8ev, python3-imgbased 1.2.13-0.1.el8ev, redhat-release-virtualization-host 4.4.3-1.el8ev, redhat-virtualization-host-image-update-placeholder 4.4.3-1.el8ev
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.14% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • Red Hat libssh

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.