CVE-2025-5372

HighCVSS 8.8/10Last modified Nov 5, 2026

Description

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-682

Affected software

Vendor	Product	Versions
libssh	libssh	< 0.11.2
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	—
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	—
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	—
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	—
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	—
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	—
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	—
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat OpenShift Container Platform 4	—
Red Hat	Red Hat OpenShift Container Platform 4	—

References

https://access.redhat.com/errata/RHSA-2025:21977
https://access.redhat.com/errata/RHSA-2025:23024
https://access.redhat.com/errata/RHSA-2026:20610
https://access.redhat.com/errata/RHSA-2026:24349
https://access.redhat.com/errata/RHSA-2026:25911
https://access.redhat.com/security/cve/CVE-2025-5372Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2369388Issue Tracking, Third Party Advisory

Timeline

Published: Jul 4, 2025
Last modified: Nov 5, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-537208.0Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.CVE-2025-537217.0Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.CVE-2025-537227.5Uncontrolled resource consumption in Windows Remote Desktop Services allows an unauthorized attacker to deny service over a network.CVE-2025-537237.8Numeric truncation error in Windows Hyper-V allows an authorized attacker to elevate privileges locally.CVE-2025-537247.8Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privile CVE-2025-537257.8Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privile CVE-2025-537267.8Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privile CVE-2025-537278.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate CVE-2025-537286.5Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclo CVE-2025-537297.8Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally.CVE-2025-53738.8A vulnerability has been found in PHPGurukul Online Birth Certificate System 2.0 and classified as critical. This vulnerability affects unkn CVE-2025-537307.8Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.