CVE-2020-14145
First published: Mon Jun 29 2020(Updated: )
OpenSSH is vulnerable to a man-in-the-middle attack, caused by an observable discrepancy flaw. An attacker could exploit this vulnerability to launch a man-in-the-middle attack and gain access to the communication channel between endpoints to obtain sensitive information or further compromise the system.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Security Guardium Insights | <=2.0.2 | |
| Openbsd Openssh | >=5.7<8.4 | |
| Openbsd Openssh | =8.4 | |
| Openbsd Openssh | =8.5 | |
| Openbsd Openssh | =8.6 | |
| Netapp Aff A700s Firmware | ||
| NetApp AFF A700s | ||
| Netapp Active Iq Unified Manager Vmware Vsphere | >=9.5 | |
| Netapp Hci Management Node | ||
| NetApp ONTAP Select Deploy administration utility | ||
| Netapp Solidfire | ||
| Netapp Steelstore Cloud Integrated Storage | ||
| Netapp Hci Compute Node | ||
| Netapp Hci Storage Node |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://exchange.xforce.ibmcloud.com/vulnerabilities/184514
- https://www.ibm.com/support/pages/node/6403463 (Advisory)
- http://www.openwall.com/lists/oss-security/2020/12/02/1
- https://anongit.mindrot.org/openssh.git/commit/?id=b3855ff053f5078ec3d3c653cdaedefaa5fc362d
- https://docs.ssh-mitm.at/CVE-2020-14145.html
- https://github.com/openssh/openssh-portable/compare/V_8_3_P1...V_8_4_P1
- https://github.com/ssh-mitm/ssh-mitm/blob/master/ssh_proxy_server/plugins/session/cve202014145.py
- https://security.gentoo.org/glsa/202105-35
- https://security.netapp.com/advisory/ntap-20200709-0004/
- https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/
Frequently Asked Questions
What is CVE-2020-14145?
CVE-2020-14145 is a vulnerability in OpenSSH that allows man-in-the-middle attackers to target initial connection attempts.
How severe is CVE-2020-14145?
CVE-2020-14145 has a severity rating of 5.9 (medium).
How does CVE-2020-14145 affect OpenSSH versions?
CVE-2020-14145 affects OpenSSH versions 5.7 through 8.4.
Is IBM Security Guardium Insights affected by CVE-2020-14145?
Yes, IBM Security Guardium Insights version 2.0.2 is affected by CVE-2020-14145.
How can I fix CVE-2020-14145 in OpenSSH?
To fix CVE-2020-14145 in OpenSSH, you should update to a version higher than 8.4.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/description
- agent/event
- agent/weakness
- agent/remedy
- agent/severity
- agent/author
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/openbsd
- canonical/openbsd openssh
- version/openbsd openssh/5.7
- version/openbsd openssh/8.4
- version/openbsd openssh/8.5
- version/openbsd openssh/8.6
- vendor/netapp
- canonical/netapp aff a700s firmware
- canonical/netapp aff a700s
- canonical/netapp active iq unified manager vmware vsphere
- version/netapp active iq unified manager vmware vsphere/9.5
- canonical/netapp hci management node
- canonical/netapp ontap select deploy administration utility
- canonical/netapp solidfire
- canonical/netapp steelstore cloud integrated storage
- canonical/netapp hci compute node
- canonical/netapp hci storage node
- vendor/ibm
- canonical/ibm security guardium insights
- version/ibm security guardium insights/2.0.2