Read the docs
TI-2020-12690 Aliases CVE-2020-16135GHSA-9j7p-fvvp-cp57

libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.

Priority LOW 33CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-476.

Summary

libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.

Why it matters now

EPSS 0.04105 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 2 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:libssh:libssh:0.9.4:*:*:*:*:*:*:*0.9.4Vulnerablelibssh
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
  • cpe:2.3:a:libssh:libssh:0.9.4:*:*:*:*:*:*:* Versions 0.9.4 Vulnerable ·libssh
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle

Remediation

Red Hat 2 advisories

  • RHSA-2021:4750 Released 2021-11-19 · Red Hat rating Important
    Red Hat Virtualization Host security and bug fix update [ovirt-4.4.9] 0-day
    • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host-4.4.9-202111172338_8.5, redhat-virtualization-host-image-update-4.4.9-202111172338_8.5
  • RHSA-2021:4387 Released 2021-11-09 · Red Hat rating Low
    libssh security update
    • Red Hat Enterprise Linux AppStream (v. 8) libssh-devel-0.9.4-3.el8
    • Red Hat Enterprise Linux BaseOS (v. 8) libssh-0.9.4-3.el8, libssh-config-0.9.4-3.el8

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:4387
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2021:4387
Red Hat Virtualization 4 Hypervisor for RHEL 8Fixed RHSA-2021:4750
Not affected: 4 products
  • RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-16135
  2. 2026-10-03 Alias added: GHSA-9j7p-fvvp-cp57

References

Exploit 1

Patch 1

Advisory 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences