CVE-2023-6918

A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.

• CWE-252
• CWE-252

• https://access.redhat.com/errata/RHSA-2024:2504
• https://access.redhat.com/errata/RHSA-2024:3233
• https://access.redhat.com/security/cve/CVE-2023-6918Mailing List, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2254997Issue Tracking, Third Party Advisory
• https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/Release Notes
• https://www.libssh.org/security/advisories/CVE-2023-6918.txtVendor Advisory
• https://access.redhat.com/errata/RHSA-2024:2504
• https://access.redhat.com/errata/RHSA-2024:3233
• https://access.redhat.com/security/cve/CVE-2023-6918Mailing List, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2254997Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/
• https://security.netapp.com/advisory/ntap-20250214-0009/
• https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/Release Notes
• https://www.libssh.org/security/advisories/CVE-2023-6918.txtVendor Advisory

Published

Dec 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-6911Multiple WSO2 products have been identified as vulnerable du…4.8
• CVE-2023-6912Lack of protection against brute force attacks in M-Files Se…9.8
• CVE-2023-6913A session hijacking vulnerability has been detected in the I…8.1
• CVE-2023-6915A Null pointer dereference problem was found in ida_free in …5.5
• CVE-2023-6916Audit records for OpenAPI requests may include sensitive inf…7.5
• CVE-2023-6917A vulnerability has been identified in the Performance Co-Pi…6.7
• CVE-2023-6919Path Traversal: '/../filedir' vulnerability in Biges Safe Li…7.5
• CVE-2023-6920Rejected reason: This flaw was found to be a duplicate of CV…
• CVE-2023-6921Blind SQL Injection vulnerability in PrestaShow Google Integ…9.1
• CVE-2023-6922The Under Construction / Maintenance Mode from Acurax plugin…6.5
• CVE-2023-6923The Matomo Analytics – Ethical Stats. Powerful Insights. plu…6.1
• CVE-2023-6924The Photo Gallery by 10Web plugin for WordPress is vulnerabl…4.8