vulnerability

Ubuntu: (CVE-2016-0787): libssh2 vulnerability

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:N/C:P/I:N/A:N)

Published

Apr 13, 2016

Added

Nov 19, 2024

Modified

Apr 16, 2026

Description

The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."

Solution

ubuntu-upgrade-libssh2

References

CVE-2016-0787
https://attackerkb.com/topics/CVE-2016-0787
CWE-200
DEBIAN-DSA-3487
EUVD-EUVD-2016-0800
https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-0800
https://www.cve.org/CVERecord?id=CVE-2016-0787
https://www.libssh2.org/adv_20160223.html

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report