CVE-2020-14145

MEDIUM

5.9

Description

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

Details CVE

Score CVSS v3.15.9

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Vecteur d'attaqueNETWORK

ComplexiteHIGH

Privileges requisNONE

Interaction utilisateurNONE

Publie6/29/2020

Derniere modification12/18/2025

Sourcenvd

Observations honeypot0

Produits affectes

netapp:active_iq_unified_managernetapp:aff_a700snetapp:aff_a700s_firmwarenetapp:hci_compute_nodenetapp:hci_management_nodenetapp:hci_storage_nodenetapp:ontap_select_deploy_administration_utilitynetapp:solidfirenetapp:steelstore_cloud_integrated_storageopenbsd:openssh

Faiblesses (CWE)

CWE-203CWE-203

References

http://www.openwall.com/lists/oss-security/2020/12/02/1(cve@mitre.org)

https://anongit.mindrot.org/openssh.git/commit/?id=b3855ff053f5078ec3d3c653cdaedefaa5fc362d(cve@mitre.org)

https://docs.ssh-mitm.at/CVE-2020-14145.html(cve@mitre.org)

https://github.com/openssh/openssh-portable/compare/V_8_3_P1...V_8_4_P1(cve@mitre.org)

https://github.com/ssh-mitm/ssh-mitm/blob/master/ssh_proxy_server/plugins/session/cve202014145.py(cve@mitre.org)

https://security.gentoo.org/glsa/202105-35(cve@mitre.org)

https://security.netapp.com/advisory/ntap-20200709-0004/(cve@mitre.org)

https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/(cve@mitre.org)

http://www.openwall.com/lists/oss-security/2020/12/02/1(af854a3a-2127-422b-91ae-364da2661108)

https://anongit.mindrot.org/openssh.git/commit/?id=b3855ff053f5078ec3d3c653cdaedefaa5fc362d(af854a3a-2127-422b-91ae-364da2661108)

https://docs.ssh-mitm.at/CVE-2020-14145.html(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/openssh/openssh-portable/compare/V_8_3_P1...V_8_4_P1(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/ssh-mitm/ssh-mitm/blob/master/ssh_proxy_server/plugins/session/cve202014145.py(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/202105-35(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20200709-0004/(af854a3a-2127-422b-91ae-364da2661108)

https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.