IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
6.5Medium

CVE-2025-5351Libssh: double free vulnerability in libssh key export functions

libssh libssh; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6 Published: (1 year ago)

Description

A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed.

Weakness (CWE): CWE-415

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
enterprise linux 9 —
libssh libssh 0.10.0 – < 0.11.2
redhat enterprise linux 6.0
redhat openshift container platform 4.0
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 6 —
Red Hat Red Hat Enterprise Linux 7 —
Red Hat Red Hat Enterprise Linux 8 all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat OpenShift Container Platform 4 all versions

References and patches

CPE matches (NVD) (7)
  • cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:* ≥ 0.10.0 < 0.11.2
  • cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*

Recent CVEs in the same product — Red Hat Enterprise Linux

5.5Medium
CVE-2026-110330

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8High
CVE-2026-110331

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…