Debian/libssh: high 8.8

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return valu

Action: Upgrade libssh to 0.10.6-0+deb12u2 or later.

Affected

Fixed versions

Sources

• osv: DEBIAN-CVE-2025-5372
• https://security-tracker.debian.org/tracker/CVE-2025-5372

published 2025-07-04T06:15:24.930Z · modified 2026-09-02T08:47:38.507661Z · JSON