← Back

CVE-2020-14145

nvd nist
Published: Jun 29, 2020Modified: Jun 17, 2026

JSON object

Loading...
5.9
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.2 / Impact: 3.6
Source: NVD

Description

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

Affected (12)

Openbsd
1 product
Openssh
Netapp
8 products
Aff A700s Firmware
Active Iq Unified Manager
Hci Compute Node
Hci Management Node
Hci Storage Node
Ontap Select Deploy Administration Utility
Solidfire
Steelstore Cloud Integrated Storage
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Openbsd
Openssh
From 5.7 to 8.4
Openssh
Version 8.4
Openssh
Version 8.5
Openssh
Version 8.6
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Aff A700s Firmware
All versions
Running on/withPlatform Versions
Netapp
Aff A700s
All versions
Configuration C
7 vulnerable
Vulnerable SoftwareAffected Versions
Active Iq Unified Manager
From 9.5
Hci Compute Node
All versions
Hci Management Node
All versions
Hci Storage Node
All versions
Ontap Select Deploy Administration Utility
All versions
Solidfire
All versions
Steelstore Cloud Integrated Storage
All versions

Related CWEs

CWE-203
Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References (16)

Source: cve@mitre.org
Mailing ListPatchThird Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.