Red Hat Security Advisory

RHSA-2025:23024

libssh security update

Released 2025-12-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.9.0) libssh-devel-0.9.6-3.el9_0.2
Red Hat Enterprise Linux BaseOS E4S (v.9.0) libssh-0.9.6-3.el9_0.2, libssh-config-0.9.6-3.el9_0.2

Fixes 1 record

TI-2025-04824 CVE-2025-5372 · GHSA-59w5-j22f-h3rv

Libssh: incorrect return code handling in ssh_kdf() in libssh

LOW 39

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00513 Published 2025-07-04 Partial fix · 0.11.2, 0.9.6-16.el8_10 +4 CWE-682