« Volver al listado

CVE-2025-5987

Estado: ModificadaAlta (8.1)—

A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad en librería remota (libssh) con AV:N sin privilegios. Impactos por contexto cifrado parcialmente inicializado: lectura de datos, manipulación de comunicaciones encriptadas y negación de servicio por crashes.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data StorageNetwork Segmentation

Tecnologías afectadas (1)

Libssh — Libssh

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-5987",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-5987",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-22T04:55:55.619672Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Secondary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "versions": [
            {
              "status": "affected",
              "version": "0.10.0",
              "lessThan": "0.11.2",
              "versionType": "semver"
            }
          ],
          "packageName": "libssh",
          "collectionURL": "https://www.libssh.org/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.1"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:0.11.1-5.el10_1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libssh",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux_eus:10.0"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:0.11.1-4.el10_0.1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libssh",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:0.10.4-17.el9_7",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libssh",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:0.10.4-17.el9_7",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libssh",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.2::appstream",
            "cpe:/o:redhat:rhel_e4s:9.2::baseos"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:0.10.4-9.el9_2.2",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libssh",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream",
            "cpe:/o:redhat:rhel_eus:9.4::baseos"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:0.10.4-13.el9_4.2",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libssh",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6::appstream",
            "cpe:/o:redhat:rhel_eus:9.6::baseos"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:0.10.4-15.el9_6.1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libssh",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "versions": [
            {
              "status": "unaffected",
              "version": "413.92.202602240113-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "versions": [
            {
              "status": "unaffected",
              "version": "414.92.202601191325-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "versions": [
            {
              "status": "unaffected",
              "version": "415.92.202601271320-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "versions": [
            {
              "status": "unaffected",
              "version": "416.94.202601160124-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "versions": [
            {
              "status": "unaffected",
              "version": "417.94.202601120213-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.18::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.18",
          "versions": [
            {
              "status": "unaffected",
              "version": "418.94.202601202224-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.19::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.19",
          "versions": [
            {
              "status": "unaffected",
              "version": "4.19.9.6.202601260820-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4.20::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4.20",
          "versions": [
            {
              "status": "unaffected",
              "version": "4.20.9.6.202601211057-0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhcos",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 6",
          "packageName": "libssh2",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 7",
          "packageName": "libssh2",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "packageName": "libssh",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4",
          "packageName": "openshift/ose-rhel-coreos-9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-07-07T15:15:28.180",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:23483",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:23484",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:0427",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:0428",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:0430",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:0431",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:0702",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:0978",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:0980",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:0985",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:0996",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:1539",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:1541",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:3415",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2025-5987",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376219",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.libssh.org/security/advisories/CVE-2025-5987.txt",
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-393"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes."
    },
    {
      "lang": "es",
      "value": "Se detectó una falla en libssh al usar el cifrado ChaCha20 con la librería OpenSSL. Si un atacante logra agotar el espacio del montón, este error no se detecta y puede provocar que libssh use un contexto de cifrado parcialmente inicializado. Esto se debe a que el código de error de OpenSSL devolvió alias con el código SSH_OK, lo que impide que libssh detecte correctamente el error devuelto por la librería OpenSSL. Este problema puede provocar un comportamiento indefinido, como la confidencialidad e integridad de los datos comprometidas o fallos."
    }
  ],
  "lastModified": "2026-08-31T18:17:11.700",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28859F90-CC03-4355-AC1B-E595AE86511A",
              "versionEndExcluding": "0.11.2",
              "versionStartIncluding": "0.10.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}