CVE-2020-14145

Katalog CVE

CVSS 5.9 · Medium EPSS 2,1%

Kerentanan Observable Discrepancy pada openbsd openssh, netapp aff a700s firmware +7 lainnya. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

Rincian

Terbit di NVD

29 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-203: Observable Discrepancy

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 80,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.openwall.com/lists/oss-security/2020/12/02/1 mailing list · patch · advisory pihak ketiga
• https://anongit.mindrot.org/openssh.git/commit/?id=b3855ff053f5078ec3d3c653cdaedefaa5fc362d patch · advisory pihak ketiga
• https://github.com/openssh/openssh-portable/compare/V_8_3_P1...V_8_4_P1 patch · advisory pihak ketiga
• https://docs.ssh-mitm.at/CVE-2020-14145.html advisory pihak ketiga
• https://github.com/ssh-mitm/ssh-mitm/blob/master/ssh_proxy_server/plugins/session/cve202014145.py advisory pihak ketiga
• https://security.gentoo.org/glsa/202105-35 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20200709-0004/ advisory pihak ketiga
• https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-... advisory pihak ketiga