CVE-2020-14145

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

Affected products

Alt Linux, Almalinux, Astra Linux, Centos, Debian, Openssh, Red Hat, Rocky Linux

Openbsd Openssh

< 8.4, 8.5, 8.6

CVSS 3.1

5.9 MEDIUM

EPSS

2.1% (80th percentile)

Weakness

CWE-203

NVD status

Modified

Published

2020-06-29