CVE-2020-14145

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-14145
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-14145.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-14145
Downstream
ALPINE (1)
ALSA (1)
BELL (1)
CLEANSTART (1)
DEBIAN (1)
ECHO (1)
JLSEC (1)
MGASA (1)
OESA (1)
openSUSE (2)
RHSA (1)
RLSA (1)
SUSE (5)
UBUNTU (1)
Related
ALSA (1)
openSUSE (2)
SUSE (5)
Published
2020-06-29T18:15:11Z
Modified
2026-10-20T10:51:49Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "9.5"
                        }
                    ],
                    "source": "CPE_RANGE"
                }
            ],
            "vendor_product": "netapp:active_iq_unified_manager"
        }
    ]
}
References

Affected packages

Git / github.com/openssh/openssh-portable

Affected ranges

Type
GIT
Repo
https://github.com/openssh/openssh-portable
Events
Introduced
6f8f04b860765da07938bfe1fef017b00c3a3d55
Fixed
279261e1ea8150c7c64ab5fe7cb4a4ea17acbb29
Introduced
279261e1ea8150c7c64ab5fe7cb4a4ea17acbb29
Last Affected
e86968280e358e62649d268d41f698d64d0dc9fa
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.7"
                },
                {
                    "fixed": "8.4"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:openbsd:openssh:8.4:-:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.4-NA"
                },
                {
                    "last_affected": "8.4-NA"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:openbsd:openssh:8.5:-:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.5-NA"
                },
                {
                    "last_affected": "8.5-NA"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:openbsd:openssh:8.6:-:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.6-NA"
                },
                {
                    "last_affected": "8.6-NA"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}

Affected versions

8.*
8.4-NA
8.5-NA
8.6-NA
Other
V_5_7_P1
V_6_0_P1
V_6_1_P1
V_6_2_P1
V_6_5_P1
V_6_6_P1
V_6_8_P1
V_6_9_P1
V_7_0_P1
V_7_1_P1
V_7_2_P1
V_7_3_P1
V_7_4_P1
V_7_5_P1
V_7_6_P1
V_7_7_P1
V_7_8_P1
V_7_9_P1
V_8_0_P1
V_8_1_P1
V_8_2_P1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-14145.json"