===========================================================
== Subject:     Possible NULL pointer de-reference when calculating KEX session id
==
== CVE ID#:     CVE-2025-8114
==
== Versions:    libssh <= 0.11.3
==
== Summary:     When an allocation error happens during the
==              calculation of the KEX session id, a NULL
==              pointer de-reference could happen.
==
===========================================================

===========
Description
===========

When libssh calculates the session id for the KEX and an error happens when
allocating memory using cryptographic functions, it is possible that we
de-reference a null pointer making the ssh client or server crash.

==================
Patch Availability
==================

Patches addressing the issues have been posted to:
https://www.libssh.org/security/
Additionally, libssh 0.11.3 have been issued as security releases to correct
the defect.  SSH administrators are advised to upgrade to these releases or
apply the patch as soon as possible.

==================
CVSSv3 calculation
==================
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (4.7)

==========
Workaround
==========

None
=======
Credits
=======

Originally reported by Philippe Antoine.
Patches provided by Philippe Antoine and reviewed by the libssh team.

==========================================================
== The libssh team
==========================================================