Index: head/security/vuxml/vuln.xml =================================================================== --- head/security/vuxml/vuln.xml +++ head/security/vuxml/vuln.xml @@ -58,6 +58,37 @@ * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + Client/server denial of service when handling AES-CTR ciphers + + + libssh + 0.8.00.8.9 + 0.9.00.9.4 + + + + +

The libssh team reports (originally reported by Yasheng Yang from + Google):

+
A malicious client or server could crash the counterpart implemented + with libssh AES-CTR ciphers are used and don't get fully initialized. It + will crash when it tries to cleanup the AES-CTR ciphers when closing the + connection.
+

+ + + + https://www.libssh.org/security/advisories/CVE-2020-1730.txt" + CVE-2020-1730 + + + 2020-04-09 + 2020-04-12 + + + chromium -- multiple vulnerabilities