CVE-2025-4878: Libssh: use of uninitialized variable in privatekey_from_file()
A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekeyfromfile() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.
Other sources
The privatekeyfromfile() uses an uninitialized variable under certain conditions, such as if the file specified by the filename argument doesn't exist. This causes the code to return an invalid private key. This defect, in turn, might cause signing failure. The bug might also cause a Use-After-Free or corrupt the heap. Note that privatekeyfromfile() is a deprecated function and shouldn't be used anymore!
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4878?
CVE-2025-4878 has been classified with a medium severity rating due to potential impacts on system integrity.
How do I fix CVE-2025-4878?
To fix CVE-2025-4878, ensure that the libssh library is updated to the latest patched version provided by the vendor.
What are the potential impacts of CVE-2025-4878?
CVE-2025-4878 can result in signing failures or heap corruption, which may compromise application stability.
Which versions of libssh are affected by CVE-2025-4878?
CVE-2025-4878 affects various versions of libssh where the vulnerable code is present.
How can I mitigate risks associated with CVE-2025-4878?
Mitigation steps for CVE-2025-4878 include implementing proper file checks before invoking the privatekey_from_file() function.