CVE-2023-6918 LOW

CVE-2023-6918: Libssh: missing checks for return values for digests

Vendor Red Hat
Product Red Hat Enterprise Linux 6
Weakness CWE-252
Published December 18, 2023
Last update November 21, 2025

CVSS base score

3.7/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.

Key dates

02Disclosure timeline

December 18, 2023 CVE published
November 21, 2025 Record updated