libssh — security advisory
A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.
- Products
- libssh
- Affected versions
- 0.10.5-2, 0.10.5-3, 0.10.5-3+hurd.1
- Fixed versions
- 0.10.6-0+deb12u1, 0.10.6-1
- CVEs
- CVE-2023-6918
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 15:43 UTC · Revision 1
Source evidence
A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.
osv:DEBIAN-CVE-2023-6918
libssh
Fixed versions: 0.10.6-0+deb12u1
libssh
Fixed versions: 0.10.6-1
libssh
Fixed versions: 0.10.6-1
Complete source record
{
"id": "405cabbe6deac0fbdb931eee448911eb9853dc8ea72e0a32810b0ec7e935791a",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2023-6918",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2023-6918",
"summary": "A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.",
"evidence": "osv:DEBIAN-CVE-2023-6918",
"products": [
{
"name": {
"value": "libssh",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.10.6-0+deb12u1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "0.10.5-2",
"evidence": "/affected/0/versions"
},
{
"value": "0.10.5-3",
"evidence": "/affected/0/versions"
},
{
"value": "0.10.5-3+hurd.1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "libssh",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.10.6-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libssh",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.10.6-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2023-6918",
"aliases": [
"DEBIAN-CVE-2023-6918"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.6-0+deb12u1"
}
]
}
],
"package": {
"name": "libssh",
"purl": "pkg:deb/debian/libssh?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"0.10.5-2",
"0.10.5-3",
"0.10.5-3+hurd.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-6918.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.6-1"
}
]
}
],
"package": {
"name": "libssh",
"purl": "pkg:deb/debian/libssh?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-6918.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.6-1"
}
]
}
],
"package": {
"name": "libssh",
"purl": "pkg:deb/debian/libssh?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-6918.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T18:01:30.879286312Z",
"provider": "osv",
"upstream": [
"CVE-2023-6918"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2023-6918"
]
},
"related_cves": [
{
"value": "CVE-2023-6918",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 455547,
"published_at": "2023-12-19T00:15:08.46+00:00"
}