{"id":"CVE-2020-16135","aliases":["ALPINE-CVE-2020-16135","ALSA-2021:4387","BELL-CVE-2020-16135","DEBIAN-CVE-2020-16135","DLA-2303-1","EUVD-2020-8101","GHSA-9j7p-fvvp-cp57","MGASA-2020-0324","MGASA-2020-0338","RHSA-2021:4387","RHSA-2021:4750","RLSA-2021:4387","SUSE-SU-2024:0525-1","SUSE-SU-2024:0539-1","UBUNTU-CVE-2020-16135","USN-4447-1","openSUSE-SU-2024:10998-1"],"status":"published","title":"libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.","description":"libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.04105,"percentile":0.90892,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2020-07-29T20:20:29Z","modified":"2026-11-03T06:32:24Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"libssh","fixed_in":["0.8.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"libssh","fixed_in":["0.9.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"libssh","fixed_in":["0.9.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"libssh","fixed_in":["0.9.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libssh","fixed_in":["0.9.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libssh","fixed_in":["0.9.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libssh","fixed_in":["0.9.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libssh","fixed_in":["0.9.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libssh","fixed_in":["0.9.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libssh","fixed_in":["0.9.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libssh","fixed_in":["0.9.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libssh","fixed_in":["0.9.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libssh","fixed_in":["0.9.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libssh","fixed_in":["0.9.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libssh","fixed_in":["0.9.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"libssh","fixed_in":["0.7.6-r3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libssh-devel","fixed_in":["0.9.4-3.el8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libssh","fixed_in":["0.9.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libssh","fixed_in":["0.9.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libssh","fixed_in":["0.9.5-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"libssh","fixed_in":["0.7.3-2+deb9u3"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"libssh","fixed_in":["0.8.9-1.1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"freerdp","fixed_in":["2.2.0-1.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libssh-debuginfo","fixed_in":["0:0.9.4-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libssh-debugsource","fixed_in":["0:0.9.4-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libssh-devel","fixed_in":["0:0.9.4-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh","fixed_in":["0:0.9.4-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh-config","fixed_in":["0:0.9.4-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh-debuginfo","fixed_in":["0:0.9.4-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh-debugsource","fixed_in":["0:0.9.4-3.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"libssh","fixed_in":["0:0.9.4-3.el8"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libssh","fixed_in":["0.6.3-4.3ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libssh","fixed_in":["0.8.0~20170825.94fa1e38-1ubuntu0.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libssh","fixed_in":["0.9.3-2ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.6-r3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.3-2+deb9u3"}]}],"versions":["0.7.3-2","0.7.3-2+deb9u1","0.7.3-2+deb9u2"]},{"source":"osv","ecosystem":"Mageia:7","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.9-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.4-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.4-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.4-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.4-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.4-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.4-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.4-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_hypervisor:4.4::el8","package":"redhat-virtualization-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.9-202111172338_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_hypervisor:4.4::el8","package":"redhat-virtualization-host-image-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.9-202111172338_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.4-3.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-3.12.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-3.12.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-3.12.2"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-4.3ubuntu0.6"}]}],"versions":["0.6.3-3ubuntu3","0.6.3-4.1","0.6.3-4.2","0.6.3-4.2ubuntu1","0.6.3-4.3","0.6.3-4.3ubuntu0.1","0.6.3-4.3ubuntu0.2","0.6.3-4.3ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~20170825.94fa1e38-1ubuntu0.7"}]}],"versions":["0.7.5-1","0.8.0~20170825.94fa1e38-1","0.8.0~20170825.94fa1e38-1build1","0.8.0~20170825.94fa1e38-1ubuntu0.1","0.8.0~20170825.94fa1e38-1ubuntu0.2","0.8.0~20170825.94fa1e38-1ubuntu0.5","0.8.0~20170825.94fa1e38-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu2.1"}]}],"versions":["0.9.0-1ubuntu1","0.9.0-1ubuntu4","0.9.0-1ubuntu5","0.9.3-2ubuntu1","0.9.3-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-4.3ubuntu0.6"}]}],"versions":["0.6.3-3ubuntu3","0.6.3-4.1","0.6.3-4.2","0.6.3-4.2ubuntu1","0.6.3-4.3","0.6.3-4.3ubuntu0.1","0.6.3-4.3ubuntu0.2","0.6.3-4.3ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~20170825.94fa1e38-1ubuntu0.7"}]}],"versions":["0.7.5-1","0.8.0~20170825.94fa1e38-1","0.8.0~20170825.94fa1e38-1build1","0.8.0~20170825.94fa1e38-1ubuntu0.1","0.8.0~20170825.94fa1e38-1ubuntu0.2","0.8.0~20170825.94fa1e38-1ubuntu0.5","0.8.0~20170825.94fa1e38-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu2.1"}]}],"versions":["0.9.0-1ubuntu1","0.9.0-1ubuntu4","0.9.0-1ubuntu5","0.9.3-2ubuntu1","0.9.3-2ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-1.2"}]}],"bundled":4}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libssh","product":"libssh"},{"vendor":"oracle","product":"communications_cloud_native_core_policy"}],"references":[{"url":"https://bugs.libssh.org/T232","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://bugs.libssh.org/rLIBSSHe631ebb3e2247dd25e9678e6827c20dc73b73238","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00034.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4447-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JNW5GBC6JFN76VEWQXMLT5F7VCZ5AJ2E/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCIKQRKXAAB4HMWM62EPZJ4DVBHIIEG6/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202011-05","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-16135","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FCIKQRKXAAB4HMWM62EPZJ4DVBHIIEG6/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JNW5GBC6JFN76VEWQXMLT5F7VCZ5AJ2E/"},{"url":"https://github.com/advisories/GHSA-9j7p-fvvp-cp57"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-16135","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-16135","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-16135","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-16135","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0324.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27036","tags":["report"]},{"url":"https://www.debian.org/lts/security/2020/dla-2303","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2020-0338.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27047","tags":["report"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases/tag/2.2.0","tags":["web"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4r38-6hq7-j3j9","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4387","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1862456","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4387.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-16135","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-16135","tags":["advisory","report"]},{"url":"https://bugs.gentoo.org/734624","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4750","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1953685","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1958101","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1974491","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1975175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1975767","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1983021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1998104","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020362","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024360","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4750.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-0512","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-0512","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-0512","tags":["advisory"]},{"url":"https://lore.kernel.org/lkml/20210301161013.666159680@linuxfoundation.org/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3620","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3620","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3620","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-43267","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-43267","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43267","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4387","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240525-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1158095","tags":["report"]},{"url":"https://bugzilla.suse.com/1168699","tags":["report"]},{"url":"https://bugzilla.suse.com/1174713","tags":["report"]},{"url":"https://bugzilla.suse.com/1189608","tags":["report"]},{"url":"https://bugzilla.suse.com/1211188","tags":["report"]},{"url":"https://bugzilla.suse.com/1211190","tags":["report"]},{"url":"https://bugzilla.suse.com/1218126","tags":["report"]},{"url":"https://bugzilla.suse.com/1218186","tags":["report"]},{"url":"https://bugzilla.suse.com/1218209","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6918","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240539-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-16135","tags":["report"]},{"url":"https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120/diffs?commit_id=1493b4466fa394b321d196ad63dd6a4fa395d337","tags":["report"]},{"url":"https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120/diffs?commit_id=dbfb7f44aa905a7103bdde9a198c1e9b0f480c2e","tags":["report"]},{"url":"https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120/diffs?commit_id=65ae496222018221080dd753a52f6d70bf3ca5f3","tags":["report"]},{"url":"https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120/diffs?commit_id=df0acab3a077bd8ae015e3e8b4c71ff31b5900fe","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4447-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10933","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-16135","description":"libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.","status":"published","published":"2020-07-29T20:20:29Z","modified":"2024-08-04T13:37:53.39Z","updated_at":"2026-11-02T14:35:59.116379Z"}],"euvd":[{"id":"EUVD-2020-8101","description":"libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.","status":"published","published":"2020-07-29T20:20:29Z","modified":"2024-08-04T13:37:53Z","updated_at":"2026-11-03T03:07:29.271552Z"}],"ghsa":[{"id":"GHSA-9j7p-fvvp-cp57","title":"libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.","description":"libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.","status":"published","published":"2022-05-24T17:24:39Z","modified":"2023-01-29T05:03:38Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:45:21.848692Z"}],"nvd":[{"id":"CVE-2020-16135","description":"libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.","status":"published","published":"2020-07-29T21:15:13.507Z","modified":"2026-06-17T02:57:45.933Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:06:10.994748Z"}],"osv":[{"id":"ALPINE-CVE-2020-16135","description":"libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.","status":"published","published":"2020-07-29T21:15:13.507Z","modified":"2026-11-03T06:32:24.229760489Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"BELL-CVE-2020-16135","title":"CVE-2020-16135 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:38.383431Z","modified":"2026-01-26T09:45:54.142232Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-16135","description":"libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.","status":"published","published":"2020-07-29T21:15:13.507Z","modified":"2026-10-24T10:30:36.672883406Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"DEBIAN-CVE-2020-16135","description":"libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.","status":"published","published":"2020-07-29T21:15:13.507Z","modified":"2026-10-26T12:01:16.251558704Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"RHSA-2021:4387","title":"Red Hat Security Advisory: libssh security update","status":"published","published":"2024-09-16T05:51:06Z","modified":"2026-06-26T12:21:16.828701144Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:4750","title":"Red Hat Security Advisory: Red Hat Virtualization Host security and bug fix update [ovirt-4.4.9] 0-day","status":"published","published":"2024-09-16T06:25:30Z","modified":"2026-06-29T10:38:27Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RLSA-2021:4387","title":"Low: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL (CVE-2020-16135)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:16:07Z","modified":"2026-02-04T23:15:04.496826Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-16135","description":"libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.","status":"published","published":"2020-07-29T21:15:00Z","modified":"2026-04-22T12:31:36.451321Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"ALSA-2021:4387","title":"Low: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL (CVE-2020-16135)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:16:07Z","modified":"2026-10-29T11:01:39.583247169Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-2303-1","title":"libssh - security update","status":"published","published":"2020-07-31T00:00:00Z","modified":"2026-03-09T01:18:09.05653Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2020-0324","title":"Updated libssh packages fix security vulnerability","description":"The code in src/sftpserver.c did not verify the validity of certain pointers\nand expected them to be valid. A NULL pointer dereference could have been\noccurred that typically causes a crash and thus a denial-of-service\n(CVE-2020-16135).\n","status":"published","published":"2020-08-18T17:41:27Z","modified":"2026-04-16T04:41:40.288203588Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"MGASA-2020-0338","title":"Updated freerdp packages fix security vulnerability","description":"Integer overflow due to missing input sanitation in rdpegfx channel. The input\nrectangles from the server are not checked against local surface coordinates\nand blindly accepted. A malicious server can send data that will crash the\nclient later on (invalid length arguments to a memcpy) (CVE-2020-15103).\n\nThe freerdp package has been updated to version 2.2.0, fixing this issue and\nother bugs.\n","status":"published","published":"2020-08-18T20:43:16Z","modified":"2026-04-16T04:43:13.690799117Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2024:10998-1","title":"libssh-config-0.9.6-1.2 on GA media","description":"These are all security issues fixed in the libssh-config-0.9.6-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:55:16.21137Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2024:0525-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\nUpdate to version 0.9.8 (jsc#PED-7719):\n\n* Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209)\n* Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126)\n* Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186)\n* Allow @ in usernames when parsing from URI composes\n\nUpdate to version 0.9.7:\n\n* Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm\n  guessing (bsc#1211188)\n* Fix CVE-2023-2283: a possible authorization bypass in\n  pki_verify_data_signature under low-memory conditions (bsc#1211190)\n* Fix several memory leaks in GSSAPI handling code\n\nUpdate to version 0.9.6 (bsc#1189608, CVE-2021-3634):\n\n* https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6\n\n\nUpdate to 0.9.5 (bsc#1174713, CVE-2020-16135):\n\n* CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232)\n* Improve handling of library initialization (T222)\n* Fix parsing of subsecond times in SFTP (T219)\n* Make the documentation reproducible\n* Remove deprecated API usage in OpenSSL\n* Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN\n* Define version in one place (T226)\n* Prevent invalid free when using different C runtimes than OpenSSL (T229)\n* Compatibility improvements to testsuite \n\nUpdate to version 0.9.4\n\n* https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/\n* Fix possible Denial of Service attack when using AES-CTR-ciphers\n  CVE-2020-1730 (bsc#1168699)\n\nUpdate to version 0.9.3\n\n* Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095)\n* SSH-01-003 Client: Missing NULL check leads to crash in erroneous state\n* SSH-01-006 General: Various unchecked Null-derefs cause DOS\n* SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys\n* SSH-01-010 SSH: Deprecated hash function in fingerprinting\n* SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS\n* SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access\n* SSH-01-001 State Machine: Initial machine states should be set explicitly\n* SSH-01-002 Kex: Differently bound macros used to iterate same array\n* SSH-01-005 Code-Quality: Integer sign confusion during assignments\n* SSH-01-008 SCP: Protocol Injection via unescaped File Names\n* SSH-01-009 SSH: Update documentation which RFCs are implemented\n* SSH-01-012 PKI: Information leak via uninitialized stack buffer\n\nUpdate to version 0.9.2\n\n* Fixed libssh-config.cmake\n* Fixed issues with rsa algorithm negotiation (T191)\n* Fixed detection of OpenSSL ed25519 support (T197)\n\nUpdate to version 0.9.1\n\n* Added support for Ed25519 via OpenSSL\n* Added support for X25519 via OpenSSL\n* Added support for localuser in Match keyword\n* Fixed Match keyword to be case sensitive\n* Fixed compilation with LibreSSL\n* Fixed error report of channel open (T75)\n* Fixed sftp documentation (T137)\n* Fixed known_hosts parsing (T156)\n* Fixed build issue with MinGW (T157)\n* Fixed build with gcc 9 (T164)\n* Fixed deprecation issues (T165)\n* Fixed known_hosts directory creation (T166)\n\n- Split out configuration to separate package to not mess up the\n  library packaging and coinstallation\n\nUpdate to verion 0.9.0\n\n* Added support for AES-GCM\n* Added improved rekeying support\n* Added performance improvements\n* Disabled blowfish support by default\n* Fixed several ssh config parsing issues\n* Added support for DH Group Exchange KEX\n* Added support for Encrypt-then-MAC mode\n* Added support for parsing server side configuration file\n* Added support for ECDSA/Ed25519 certificates\n* Added FIPS 140-2 compatibility\n* Improved known_hosts parsing\n* Improved documentation\n* Improved OpenSSL API usage for KEX, DH, and signatures\n\n- Add libssh client and server config files\n","status":"published","published":"2024-02-19T07:04:14Z","modified":"2026-02-04T03:01:50.419082Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0539-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\nUpdate to version 0.9.8 (jsc#PED-7719):\n\n* Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209)\n* Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126)\n* Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186)\n* Allow @ in usernames when parsing from URI composes\n\nUpdate to version 0.9.7\n\n* Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm\n  guessing (bsc#1211188)\n* Fix CVE-2023-2283: a possible authorization bypass in\n  pki_verify_data_signature under low-memory conditions (bsc#1211190)\n* Fix several memory leaks in GSSAPI handling code\n\nUpdate to version 0.9.6 (bsc#1189608, CVE-2021-3634)\n\n* https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6\n\nUpdate to version 0.9.5 (bsc#1174713, CVE-2020-16135):\n\n* CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232)\n* Improve handling of library initialization (T222)\n* Fix parsing of subsecond times in SFTP (T219)\n* Make the documentation reproducible\n* Remove deprecated API usage in OpenSSL\n* Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN\n* Define version in one place (T226)\n* Prevent invalid free when using different C runtimes than OpenSSL (T229)\n* Compatibility improvements to testsuite \n\nUpdate to version 0.9.4:\n\n* https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/\n* Fix possible Denial of Service attack when using AES-CTR-ciphers\n  CVE-2020-1730 (bsc#1168699)\n\nUpdate to version 0.9.3:\n\n* Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095)\n* SSH-01-003 Client: Missing NULL check leads to crash in erroneous state\n* SSH-01-006 General: Various unchecked Null-derefs cause DOS\n* SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys\n* SSH-01-010 SSH: Deprecated hash function in fingerprinting\n* SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS\n* SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access\n* SSH-01-001 State Machine: Initial machine states should be set explicitly\n* SSH-01-002 Kex: Differently bound macros used to iterate same array\n* SSH-01-005 Code-Quality: Integer sign confusion during assignments\n* SSH-01-008 SCP: Protocol Injection via unescaped File Names\n* SSH-01-009 SSH: Update documentation which RFCs are implemented\n* SSH-01-012 PKI: Information leak via uninitialized stack buffer\n\nUpdate to version 0.9.2:\n\n* Fixed libssh-config.cmake\n* Fixed issues with rsa algorithm negotiation (T191)\n* Fixed detection of OpenSSL ed25519 support (T197)\n\nUpdate to version 0.9.1:\n\n* Added support for Ed25519 via OpenSSL\n* Added support for X25519 via OpenSSL\n* Added support for localuser in Match keyword\n* Fixed Match keyword to be case sensitive\n* Fixed compilation with LibreSSL\n* Fixed error report of channel open (T75)\n* Fixed sftp documentation (T137)\n* Fixed known_hosts parsing (T156)\n* Fixed build issue with MinGW (T157)\n* Fixed build with gcc 9 (T164)\n* Fixed deprecation issues (T165)\n* Fixed known_hosts directory creation (T166)\n\nUpdate to verion 0.9.0:\n\n* Added support for AES-GCM\n* Added improved rekeying support\n* Added performance improvements\n* Disabled blowfish support by default\n* Fixed several ssh config parsing issues\n* Added support for DH Group Exchange KEX\n* Added support for Encrypt-then-MAC mode\n* Added support for parsing server side configuration file\n* Added support for ECDSA/Ed25519 certificates\n* Added FIPS 140-2 compatibility\n* Improved known_hosts parsing\n* Improved documentation\n* Improved OpenSSL API usage for KEX, DH, and signatures\n\n- Add libssh client and server config files\n","status":"published","published":"2024-02-20T15:03:55Z","modified":"2026-02-04T03:19:38.620325Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"USN-4447-1","title":"libssh vulnerability","description":"It was discovered that libssh incorrectly handled certain requests.\nAn attacker could possibly use this issue to cause a denial of service.\n","status":"published","published":"2020-08-04T13:31:06Z","modified":"2026-04-22T10:06:48.641534Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}