{"id":"CVE-2020-14145","aliases":["ALPINE-CVE-2020-14145","ALSA-2021:4368","BELL-CVE-2020-14145","DEBIAN-CVE-2020-14145","EUVD-2020-6303","GHSA-96g2-7cqx-5ggh","JLSEC-2026-63","MGASA-2021-0118","OESA-2021-1120","RHSA-2021:4368","RLSA-2021:4368","SUSE-SU-2020:3736-1","SUSE-SU-2020:3844-1","SUSE-SU-2020:3866-1","SUSE-SU-2020:3882-1","SUSE-SU-2021:0022-1","UBUNTU-CVE-2020-14145","openSUSE-SU-2020:2240-1","openSUSE-SU-2020:2298-1"],"status":"published","title":"The client side in OpenSSH 5.7 through 8.3 has an Observable Discrepancy leading to an...","description":"The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02949,"percentile":0.87277,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-203"],"published":"2020-06-29T17:33:36Z","modified":"2026-10-29T11:01:27Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"openssh","fixed_in":["8.3_p1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"openssh","fixed_in":["8.4_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"openssh","fixed_in":["8.4_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"openssh","fixed_in":["8.4_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"openssh","fixed_in":["8.4_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openssh","fixed_in":["8.4_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openssh","fixed_in":["8.4_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openssh","fixed_in":["8.4_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openssh","fixed_in":["8.4_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openssh","fixed_in":["8.4_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssh","fixed_in":["8.4_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssh","fixed_in":["8.4_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssh","fixed_in":["8.4_p1-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"openssh-askpass","fixed_in":["8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Julia","package":"OpenSSH_jll","fixed_in":["9.1.0+0"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"openssh","fixed_in":["8.0p1-1.1.mga7"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS","package":"openssh","fixed_in":["8.2p1-10.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"openssh","fixed_in":["8.2p1-10.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-askpass","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-askpass-debuginfo","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-cavs-debuginfo","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-clients-debuginfo","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-debuginfo","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-debugsource","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-keycat-debuginfo","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-ldap-debuginfo","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-server-debuginfo","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pam_ssh_agent_auth-debuginfo","fixed_in":["0:0.10.3-7.10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-askpass-debuginfo","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-cavs","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-cavs-debuginfo","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-clients","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-clients-debuginfo","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-debuginfo","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-debugsource","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-keycat","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-keycat-debuginfo","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-ldap","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-ldap-debuginfo","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-server","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-server-debuginfo","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam_ssh_agent_auth","fixed_in":["0:0.10.3-7.10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam_ssh_agent_auth-debuginfo","fixed_in":["0:0.10.3-7.10.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"openssh","fixed_in":["0:8.0p1-10.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"openssh","fixed_in":["8.1p1-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"openssh-askpass-gnome","fixed_in":["8.1p1-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"openssh","fixed_in":["8.1p1-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"openssh","fixed_in":["7.2p2-78.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"openssh-askpass-gnome","fixed_in":["7.2p2-78.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openssh","fixed_in":["7.2p2-78.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openssh-askpass-gnome","fixed_in":["7.2p2-78.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openssh","fixed_in":["7.2p2-78.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openssh-askpass-gnome","fixed_in":["7.2p2-78.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"openssh","fixed_in":["7.2p2-78.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"openssh-askpass-gnome","fixed_in":["7.2p2-78.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"openssh","fixed_in":["7.2p2-78.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"openssh-askpass-gnome","fixed_in":["7.2p2-78.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"openssh","fixed_in":["7.2p2-78.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"openssh-askpass-gnome","fixed_in":["7.2p2-78.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"openssh","fixed_in":["7.9p1-6.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"openssh-askpass-gnome","fixed_in":["7.9p1-6.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"openssh","fixed_in":["7.9p1-6.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"openssh","fixed_in":["7.6p1-9.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"openssh","fixed_in":["7.6p1-9.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"openssh","fixed_in":["7.6p1-9.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"openssh","fixed_in":["7.6p1-9.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openssh","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"openssh","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"openssh","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openssh","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openssh","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openssh","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"openssh","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"openssh","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"openssh","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"openssh","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 5","package":"openssh","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 5","package":"openssh-askpass-gnome","fixed_in":["7.2p2-74.57.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"openssh","fixed_in":["8.1p1-lp152.4.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"openssh-askpass-gnome","fixed_in":["8.1p1-lp152.4.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"openssh","fixed_in":["7.9p1-lp151.4.18.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"openssh-askpass-gnome","fixed_in":["7.9p1-lp151.4.18.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7"},{"fixed":"8.3_p1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7"},{"fixed":"8.4_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7"},{"fixed":"8.4_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7"},{"fixed":"8.4_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7"},{"fixed":"8.4_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7"},{"fixed":"8.4_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7"},{"fixed":"8.4_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7"},{"fixed":"8.4_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7"},{"fixed":"8.4_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7"},{"fixed":"8.4_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7"},{"fixed":"8.4_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7"},{"fixed":"8.4_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7"},{"fixed":"8.4_p1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0p1-1","1:10.0p1-2","1:10.0p1-3","1:10.0p1-4","1:10.0p1-5","1:10.0p1-5~bpo12+2","1:10.0p1-6","1:10.0p1-7","1:10.0p1-7~bpo12+1","1:10.0p1-8","1:10.1p1-1","1:10.1p1-2","1:10.2p1-1","1:10.2p1-2","1:10.2p1-2~bpo13+1","1:10.2p1-3","1:10.2p1-4","1:10.2p1-5","1:10.2p1-6","1:10.2p1-6~bpo13+1","1:10.3p1-1","1:10.3p1-1~bpo13+1","1:10.3p1-2","1:10.3p1-3","1:10.3p1-4","1:10.3p1-5","1:10.3p1-7","1:10.3p1-8","1:10.3p1-9","1:10.4p1-1","1:10.4p1-2","1:10.4p1-3","1:10.4p1-4","1:10.4p1-5","1:10.5p1-1","1:10.6p1-1","1:9.2p1-2","1:9.2p1-2+deb12u1","1:9.2p1-2+deb12u10","1:9.2p1-2+deb12u2","1:9.2p1-2+deb12u3","1:9.2p1-2+deb12u4","1:9.2p1-2+deb12u5","1:9.2p1-2+deb12u6","1:9.2p1-2+deb12u7","1:9.2p1-2+deb12u8","1:9.2p1-2+deb12u9","1:9.3p1-1","1:9.3p1-1+loong64","1:9.3p2-1","1:9.4p1-1","1:9.5p1-1","1:9.5p1-2","1:9.6p1-1","1:9.6p1-2","1:9.6p1-3","1:9.6p1-4","1:9.6p1-5","1:9.7p1-1","1:9.7p1-2","1:9.7p1-3","1:9.7p1-3+hurd.1","1:9.7p1-4","1:9.7p1-5","1:9.7p1-6","1:9.7p1-7","1:9.8p1-1","1:9.8p1-2","1:9.8p1-3","1:9.8p1-4","1:9.8p1-7","1:9.8p1-8","1:9.9p1-1","1:9.9p1-2","1:9.9p1-3","1:9.9p1-3+hurd.1","1:9.9p2-1","1:9.9p2-2"]},{"source":"osv","ecosystem":"Debian:13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0p1-7","1:10.0p1-7+deb13u1","1:10.0p1-7+deb13u2","1:10.0p1-7+deb13u3","1:10.0p1-7+deb13u4","1:10.0p1-8","1:10.1p1-1","1:10.1p1-2","1:10.2p1-1","1:10.2p1-2","1:10.2p1-2~bpo13+1","1:10.2p1-3","1:10.2p1-4","1:10.2p1-5","1:10.2p1-6","1:10.2p1-6~bpo13+1","1:10.3p1-1","1:10.3p1-1~bpo13+1","1:10.3p1-2","1:10.3p1-3","1:10.3p1-4","1:10.3p1-5","1:10.3p1-7","1:10.3p1-8","1:10.3p1-9","1:10.4p1-1","1:10.4p1-2","1:10.4p1-3","1:10.4p1-4","1:10.4p1-5","1:10.5p1-1","1:10.6p1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0p1-7","1:10.0p1-8","1:10.1p1-1","1:10.1p1-2","1:10.2p1-1","1:10.2p1-2","1:10.2p1-2~bpo13+1","1:10.2p1-3","1:10.2p1-4","1:10.2p1-5","1:10.2p1-6","1:10.2p1-6~bpo13+1","1:10.3p1-1","1:10.3p1-1~bpo13+1","1:10.3p1-2","1:10.3p1-3","1:10.3p1-4","1:10.3p1-5","1:10.3p1-7","1:10.3p1-8","1:10.3p1-9","1:10.4p1-1","1:10.4p1-2","1:10.4p1-3","1:10.4p1-4","1:10.4p1-5","1:10.5p1-1","1:10.6p1-1"]},{"source":"osv","ecosystem":"Julia","package":"OpenSSH_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.1.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0p1-1.1.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2p1-10.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2p1-10.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-cavs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-7.10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-cavs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-7.10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-7.10.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-10.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1p1-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1p1-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1p1-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-78.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-78.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-78.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-78.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-78.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-78.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-78.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-78.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-78.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-78.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-78.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-78.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9p1-6.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9p1-6.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9p1-6.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.57.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1p1-lp152.4.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1p1-lp152.4.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9p1-lp151.4.18.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9p1-lp151.4.18.1"}]}]}],"products":[{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"aff_a700s_firmware"},{"vendor":"netapp","product":"hci_compute_node"},{"vendor":"netapp","product":"hci_management_node"},{"vendor":"netapp","product":"hci_storage_node"},{"vendor":"netapp","product":"ontap_select_deploy_administration_utility"},{"vendor":"netapp","product":"solidfire"},{"vendor":"netapp","product":"steelstore_cloud_integrated_storage"},{"vendor":"openbsd","product":"openssh"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://github.com/openssh/openssh-portable/compare/V_8_3_P1...V_8_4_P1","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20200709-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2020/12/02/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix","web"]},{"url":"https://anongit.mindrot.org/openssh.git/commit/?id=b3855ff053f5078ec3d3c653cdaedefaa5fc362d","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://docs.ssh-mitm.at/CVE-2020-14145.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/ssh-mitm/ssh-mitm/blob/master/ssh_proxy_server/plugins/session/cve202014145.py","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202105-35","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14145","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20200709-0004"},{"url":"https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients"},{"url":"https://github.com/advisories/GHSA-96g2-7cqx-5ggh"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-14145","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-14145","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-14145","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-14145","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0118.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27706","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OTSUNUWKKFI2BZV3IR5RLHAQFXINNKM7/","tags":["web","advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1120","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4368","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1836277","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1843372","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1852930","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1879503","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1901518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1909988","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1913041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1933517","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4368.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14145","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14145","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4368","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203736-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173513","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14145","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203844-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1148566","tags":["report"]},{"url":"https://bugzilla.suse.com/1161684","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203866-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1115550","tags":["report"]},{"url":"https://bugzilla.suse.com/1139398","tags":["report"]},{"url":"https://bugzilla.suse.com/1142000","tags":["report"]},{"url":"https://bugzilla.suse.com/1174162","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203882-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210022-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-14145","tags":["report"]},{"url":"https://www.fzi.de/fileadmin/user_upload/2020-06-26-FSA-2020-2.pdf","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6279-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/D34ALFN2MMC67CCWTOANPH5DLTSAHLOG/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-14145","description":"The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.","status":"published","published":"2020-06-29T17:33:36Z","modified":"2026-10-14T09:29:18.19Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:35:46.476719Z"}],"euvd":[{"id":"EUVD-2020-6303","description":"The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.","status":"published","published":"2020-06-29T17:33:36Z","modified":"2026-10-14T09:29:18Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:16.85534Z"}],"ghsa":[{"id":"GHSA-96g2-7cqx-5ggh","title":"The client side in OpenSSH 5.7 through 8.3 has an Observable Discrepancy leading to an...","description":"The client side in OpenSSH 5.7 through 8.3 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).","status":"published","published":"2022-05-24T17:22:01Z","modified":"2026-10-14T12:31:15Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-203"],"updated_at":"2026-11-02T15:13:24.188405Z"}],"nvd":[{"id":"CVE-2020-14145","description":"The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.","status":"published","published":"2020-06-29T18:15:11.94Z","modified":"2026-10-14T10:17:29.537Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:06:08.145904Z"}],"osv":[{"id":"ALPINE-CVE-2020-14145","description":"The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.","status":"published","published":"2020-06-29T18:15:11.94Z","modified":"2026-10-26T11:17:55.115303546Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2020-14145","title":"CVE-2020-14145 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:04.244368Z","modified":"2026-01-26T09:45:49.137502Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2020-14145","description":"The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.","status":"published","published":"2020-06-29T18:15:11.94Z","modified":"2026-10-20T10:51:49.062474124Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-14145","description":"The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.","status":"published","published":"2020-06-29T18:15:11.94Z","modified":"2026-10-26T12:00:40.603488307Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"JLSEC-2026-63","description":"The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.","status":"published","published":"2026-04-09T21:32:46.691Z","modified":"2026-07-18T00:02:16.472086012Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2021-1120","title":"openssh security update","description":"OpenSSH is the premier connectivity tool for remote login with the SSH protocol. It encrypts all traffic to eliminate eavesdropping, connection hijacking, and other attacks. In addition, OpenSSH provides a large suite of secure tunneling capabilities, several authentication methods, and sophisticated configuration options.\r\n\r\nSecurity Fix(es):\r\n\r\nThe client side in OpenSSH 5.7 through 8.3 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).(CVE-2020-14145)","status":"published","published":"2021-04-07T11:04:21Z","modified":"2026-08-18T01:15:26.190985581Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:4368","title":"Red Hat Security Advisory: openssh security update","status":"published","published":"2024-09-16T05:38:57Z","modified":"2026-06-26T12:21:16.246640709Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4368","title":"Moderate: openssh security update","description":"OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.\n\nSecurity Fix(es):\n\n* openssh: Observable discrepancy leading to an information leak in the algorithm negotiation (CVE-2020-14145)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:11:41Z","modified":"2026-02-05T08:30:09.561538Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-14145","description":"The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.","status":"withdrawn","published":"2020-06-29T18:15:00Z","modified":"2026-02-04T14:22:23.161333Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"ALSA-2021:4368","title":"Moderate: openssh security update","description":"OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.\n\nSecurity Fix(es):\n\n* openssh: Observable discrepancy leading to an information leak in the algorithm negotiation (CVE-2020-14145)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:11:41Z","modified":"2026-10-29T11:01:27.514173419Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"MGASA-2021-0118","title":"Updated openssh packages fix a security vulnerability","description":"The client side in OpenSSH 5.7 through 8.3 has an Observable Discrepancy\nleading to an information leak in the algorithm negotiation. This allows\nman-in-the-middle attackers to target initial connection attempts (where no\nhost key for the server has been cached by the client) (CVE-2020-14145).\n","status":"published","published":"2021-03-12T01:25:47Z","modified":"2026-04-16T04:42:18.926878178Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:2240-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\n- CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-12-13T05:24:47Z","modified":"2026-02-04T02:54:39.885369Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:2298-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\n- CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).\n- Supplement libgtk-3-0 instead of libX11-6 to avoid installation on a textmode install (bsc#1142000)\n- Fixed an issue where oracle cluster with  cluvfy using 'scp' failing/missinterpreted (bsc#1148566).\n- Fixed sshd termination of multichannel sessions with non-root users (bsc#1115550,bsc#1174162).\n- Added speculative hardening for key storage (bsc#1139398).  \n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-12-20T15:22:29Z","modified":"2026-02-04T03:07:39.781482Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"SUSE-SU-2020:3736-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\n- CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).\n","status":"published","published":"2020-12-09T17:20:13Z","modified":"2026-02-04T04:35:41.644007Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2020:3844-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\n- CVE-2020-14145: Fixed an observable discrepancy leading to an information leak in the algorithm negotiation (bsc#1173513).\n- Fixed an issue where AuthorizedKeysCommand produced a lot of output (bsc#1161684).\n- Fixed an issue where oracle cluster with  cluvfy using 'scp' failing/missinterpreted (bsc#1148566).\n","status":"published","published":"2020-12-16T09:42:17Z","modified":"2026-02-04T03:37:36.890776Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2020:3866-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\n- CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).\n- Supplement libgtk-3-0 instead of libX11-6 to avoid installation on a textmode install (bsc#1142000)\n- Fixed an issue where oracle cluster with  cluvfy using 'scp' failing/missinterpreted (bsc#1148566).\n- Fixed sshd termination of multichannel sessions with non-root users (bsc#1115550,bsc#1174162).\n- Added speculative hardening for key storage (bsc#1139398).  \n","status":"published","published":"2020-12-17T11:06:21Z","modified":"2026-02-04T04:03:55.400382Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2020:3882-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\n- CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).\n- Fixed an issue where oracle cluster with cluvfy using 'scp' failing/missinterpreted (bsc#1148566).\n","status":"published","published":"2020-12-18T15:47:41Z","modified":"2026-02-04T04:21:15.214388Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0022-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\n- CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).\t  \n","status":"published","published":"2021-01-05T09:22:13Z","modified":"2026-02-04T02:46:26.918871Z","updated_at":"2026-11-02T15:53:48.690034Z"}]}}