CVE-2023-6918: fedoraproject fedora Unchecked Return Value
Vulnerability summary
CVE-2023-6918 is a medium (CVSS 5.3) Unchecked Return Value vulnerability in fedoraproject fedora. EPSS estimates a 1.41% chance of exploitation in the next 30 days, higher than 72.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 10 · Related 9Timeline
- 18-12-2023PublishedVulnerability first disclosed.
- 21-11-2025Last modifiedVulnerability information updated.
Description
A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.
CVSS metrics
6 scores · 6 sources · 1 version- CVE.orgCNA3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · WolfiEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
EPSS trend
Probability
1.41%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
0.00 pp
From 1.41% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard2 products
- libssh< 0.10.6-r0
- libssh2All versions (No fix recorded)
Wolfi2 products
- libssh< 0.10.6-r0
- libssh2All versions (No fix recorded)
Debian1 product
- libssh< 0.10.6-0+deb12u1 | < 0.10.6-1
Fedoraproject1 product
- fedoraEOL38 | 39
Libssh1 product
- libssh≥ 0.9.0, < 0.9.8 | ≥ 0.10.0, < 0.10.6
Redhat1 product
- enterprise_linux8.0 | 9.0
Ubuntu1 product
- libssh< 0.6.3-4.3ubuntu0.6+esm1 | < 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm3 | < 0.9.3-2ubuntu2.5 | < 0.9.6-2ubuntu0.22.04.3
7 vendors · 9 products
References
17 links- access.redhat.com/security/cve/CVE-2023-6918VDB EntryX Refsource REDHATREPORTAdvisoryMailing ListVendor Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2254997Issue TrackingX Refsource REDHATREPORTThird Party Advisory
