CVE-2020-1730

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-476

Affected software

No affected versions have been published.

Timeline

Published
Apr 13, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-17319.8A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random adminCVE-2020-17324.2A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption acrossCVE-2020-17335.0A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unpriviCVE-2020-17347.4A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() wiCVE-2020-17354.6A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then chCVE-2020-173528.8Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through 2020-08-05 potentially allow an authenticated attaCVE-2020-173539.8scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-pCVE-2020-173548.6LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated bCVE-2020-173557.5Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a deniaCVE-2020-17363.3A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destCVE-2020-173607.8An issue was discovered in ReadyTalk Avian 1.2.0. The vm::arrayCopy method defined in classpath-common.h contains multiple boundary checks tCVE-2020-173615.5An issue was discovered in ReadyTalk Avian 1.2.0. The vm::arrayCopy method defined in classpath-common.h returns silently when a negative le
CVE-2020-1730: Medium severity, CVSS 5.3 | Vulnix