{"action":"Upgrade libssh to 0.9.6-1 or later.","affected":[{"fixed":"0.9.6-1","introduced":"0"}],"component":"libssh","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["0.9.6-1"],"id":"tcs_01M5NFTB95S4VTQQYMT07VT9T8","modified_at":"2026-10-23T18:05:22.856398014Z","published_at":"2021-08-31T17:15:08.323Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2021-3634","https://security-tracker.debian.org/tracker/CVE-2021-3634"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2021-3634#Debian:13/libssh","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2021-3634"}],"summary":"A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other sessi"}