===========================================================
== Subject:     ssh_kdf() returns a success code on certain failures
==
== CVE ID#:     CVE-2025-5372
==
== Versions:    All libssh versions built with OpenSSL < 3.0
==
== Summary:     ssh_kdf() returns a success code on certain
==              failures.
==
===========================================================

===========
Description
===========

ssh_kdf() returns a success code on certain failures for libssh built with OpenSSL < 3.0

This is caused by the alias of OpenSSL return value 0 (failure) with libssh
SSH_OK (0).  Returning success code from the ssh_kdf() function without
initializing the output buffers can lead to use of uninitialized cryptographic
keys and failing to encrypt/decrypt following communication.

==================
Patch Availability
==================

Patches addressing the issues have been posted to:
https://www.libssh.org/security/

Additionally, libssh 0.11.2 have been issued as security releases to correct
the defect.  SSH administrators are advised to upgrade to these releases or
apply the patch as soon as possible.

==================
CVSSv3 calculation
==================
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C (4.5)

==========
Workaround
==========
Build libssh with OpenSSL 3.0+.

=======
Credits
=======

Originally reported by Ronald Crane (Hackerone: tdp3kel9g) via Zippenhop LLC
Patches provided by Jakub Jelen from the libssh team.

==========================================================
== The libssh team
==========================================================