What’s Vulnerable › Vulnerabilities

CVE-2023-1667

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-05-26 · updated 2026-06-17
• Weakness: CWE-476

Description

A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.

Affected products

• Debian Linux: 10.0
• Fedoraproject Fedora: 37
• libssh: from 0.9.1 through 0.9.6; from 0.10.0 through 0.10.4
• Red Hat Enterprise Linux: 8.0, 9.0

References

• http://www.libssh.org/security/advisories/CVE-2023-1667.txt
• https://access.redhat.com/security/cve/CVE-2023-1667
• https://bugzilla.redhat.com/show_bug.cgi?id=2182199
• https://lists.debian.org/debian-lts-announce/2023/05/msg00029.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27PD44ALQTZXX7K6JAM3BXBUHYA6DFFN/
• https://security.gentoo.org/glsa/202312-05
• http://www.libssh.org/security/advisories/CVE-2023-1667.txt
• https://access.redhat.com/security/cve/CVE-2023-1667
• https://bugzilla.redhat.com/show_bug.cgi?id=2182199
• https://lists.debian.org/debian-lts-announce/2023/05/msg00029.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27PD44ALQTZXX7K6JAM3BXBUHYA6DFFN/
• https://security.gentoo.org/glsa/202312-05

Get alerted when CVE-2023-1667 or the next vulnerability affects your stack