Medium severity · published Jun 29, 2020
CVE-2020-14145
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation
5.9
CVSS
2.9%
EPSS
No
On KEV
Description
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Active IQ Unified Manager · Netapp
9.5 and later · source: NVD
AA
Aff A700s Firmware · Netapp
All versions, or not specified · source: NVD
HC
Hci Compute Node · Netapp
All versions, or not specified · source: NVD
HM
Hci Management Node · Netapp
All versions, or not specified · source: NVD
HS
Hci Storage Node · Netapp
All versions, or not specified · source: NVD
OS
Ontap Select Deploy Administration Utility · Netapp
All versions, or not specified · source: NVD
OP
Openssh · Openbsd
5.7 before 8.4; 8.4; 8.5; 8.6 · source: NVD
SO
Solidfire · Netapp
All versions, or not specified · source: NVD
SC
Steelstore Cloud Integrated Storage · Netapp
All versions, or not specified · source: NVD
SS
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
SS
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
SS
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-14145
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-14145
Mailing List
http://www.openwall.com/lists/oss-security/2020/12/02/1
Patch
https://anongit.mindrot.org/openssh.git/commit/?id=b3855ff053f5078ec3d3c653cdaedefaa5fc362d
Third Party Advisory
https://docs.ssh-mitm.at/CVE-2020-14145.html
Patch
https://github.com/openssh/openssh-portable/compare/V_8_3_P1...V_8_4_P1
Third Party Advisory
https://github.com/ssh-mitm/ssh-mitm/blob/master/ssh_proxy_server/plugins/session/cve202014145.py
Third Party Advisory
https://security.gentoo.org/glsa/202105-35
More from Active IQ Unified Manager
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
8.8
CVE-2023-41993
Apple Multiple Products WebKit Code Execution Vulnerability
8.8
CVE-2023-4863
Google Chromium WebP Heap-Based Buffer Overflow Vulnerability
8.1
CVE-2018-11776
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like…
8.1
CVE-2017-12617
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g