CVE-2025-5372
CVE-2025-5372: 2 tracked advisory records across NetApp, Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
NetApp
1 advisory- Advisory severityMedium5.0
Medium [CVE-2025-5372] Libssh Vulnerability in NetApp Products
NTAP-20250801-0005Source published Source updated
Multiple NetApp products incorporate libssh. Libssh versions built with OpenSSL versions older than 3.0 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
- Affected products in this advisory
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Red Hat
1 advisory- Advisory severityMedium5.0
Medium [CVE-2025-5372] Libssh: incorrect return code handling in ssh_kdf in libssh
CVE-2025-5372Source published Source updated
A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate due to the combination of limited prerequisites and its impact on confidentiality, integrity, and availability. Successful exploitation could allow an attacker to…
- Affected products in this advisory
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
- Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
- Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
7 more entries in the full advisory.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- libssh-0:0.9.6-16.el8_10
- libssh-0:0.9.4-2.el8_4.2
- libssh-0:0.9.6-4.el8_6.2
- libssh-0:0.9.6-13.el8_8.2
6 more entries in the full advisory.
- Mitigation guidance
- To mitigate this issue, administrators should ensure that libssh is built against OpenSSL version 3.0 or later. This change eliminates the return code mismatch and prevents the erroneous use of uninitialized key material. It is also strongly recommended to apply vendor supplied patches or update to the latest libssh security release as soon as possible.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.