Invalid return code for chacha20 poly1305 with OpenSSL backend
CVE: CVE-2025-5987
Component: libssh
CWE: CWE-393
Severity: Moderate
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-04-26T00:00:00+00:00

A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.

Statement: Red Hat Product Security Team has rated this vulnerability as having a Moderate security impact. This is due to the high complexity in exploiting this flaw. For a successful attack to take place an attacker needs to manage to exhaust the heap space to for the OpenSSL library to return the error code which wrongly match the SSH_OK return code.

Remediation:
For OpenShift Container Platform 4.13 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes

You may download the oc tool and use it to inspect release image metadata
for x86_64 architecture. The image digest may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release is as follows:

      (For x86_64 architecture)
      The image digest is sha256:a7c362225f22ef51feca9c9959409ffc5f8308a9ecc06ed2cc39b31668327eba

All OpenShift Container Platform 4.13 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:9e91245847127c920394c66c06a2c5485a1e5e54c8254326f18c04fee139fb43

      (For s390x architecture)
      The image digest is sha256:cf49729558f112fb860b847d6a036b5545ecbf3d7ecce1107081251373be848e

      (For ppc64le architecture)
      The image digest is sha256:4bf0c14c8511361620a3d6c098f087ae6f4be7b4972314cadbabb3945f43b517

      (For aarch64 architecture)
      The image digest is sha256:279e8a5c8c3954f85de55780ac18e84cc21e052836131e921f1305094b1b4029

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.15 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:d517885ee59d46c2aca8be69fdcf916f78a510ae76a5a9f7875c1c5ab3cfc3c1

      (For s390x architecture)
      The image digest is sha256:3a4a7c87e8ca5f4e3803f8f203599b25055276a532df8e0b66ec4ec2ebc51f4c

      (For ppc64le architecture)
      The image digest is sha256:f34818181660a9f58a59e06dbe58f24de82dcbb688e5f940a41e62e08f1edf94

      (For aarch64 architecture)
      The image digest is sha256:24eeb2ea15ac709ed08df9b6f1a5d1ac334c4f7335c0ae5249e17298ab297517

All OpenShift Container Platform 4.15 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.16 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:c2684677867b7aa2270ae03d6b7a0f0a61e5b97d8567a986210f2b2971115d0d

      (For s390x architecture)
      The image digest is sha256:ca335903e10d59e71bf4f036702a4ffd93861915d7eb7c4f75973c9a4795cfd5

      (For ppc64le architecture)
      The image digest is sha256:adac35f7896b1f1dc9fa32fc080d05462695c7012a82cc2faf89d68dd9de3518

      (For aarch64 architecture)
      The image digest is sha256:4986b8a4f29546033253ea396ebcf34207eba4eb4225558accbf304945168434

All OpenShift Container Platform 4.16 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.17 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:d49a4f1a4532e3822e8769a97d87f538f9101701d3997e6e883c8abff7b58a43

      (For s390x architecture)
      The image digest is sha256:baded7c05358eda3d7bc20efdc3d2b963ba80f1639c2c80b2c58bc216a1375d1

      (For ppc64le architecture)
      The image digest is sha256:4714f7f59793e8f77cc5a95eb918bd43f9a6ff31de1b35fb59b45a07f7a3f118

      (For aarch64 architecture)
      The image digest is sha256:73e2429c13a91ea4e5031c61f94c57884a7251ece3e1bbb338523e7bf8246903

All OpenShift Container Platform 4.17 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:6177c447b98c36a42fd45fa2ba413da73d14d0a7ad3aecfa977554f5ae9583cc

      (For s390x architecture)
      The image digest is sha256:b84aa7396941fa0af870b76d528da30613f54aff04d3c7b4a6a9fa20310aad03

      (For ppc64le architecture)
      The image digest is sha256:e5b841ed0aebf1920a2e0993839e46504d9d6ff363da0b5d2d2f1daea77fbfd0

      (For aarch64 architecture)
      The image digest is sha256:5a01f33ad1a21ab6bad55d866699be803d36309fe5b099782555169b1ac78be1

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:7bf7c5dabc70518b89130ff7cfe62d14a61ed800adb418359bd9dcaa17b50206

      (For s390x architecture)
      The image digest is sha256:7b2eb7420e10ac8d5e1e5698393235bcad236172c49e688dff2ee651668caf29

      (For ppc64le architecture)
      The image digest is sha256:7213776b521925f53a6a2dfac72adb9a6f9df9710dd39c8847bd6ef211aad63c

      (For aarch64 architecture)
      The image digest is sha256:369335090d5f4f5b4853e22c750ef7749ae18320be610d50f7314bb917e2b617

All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.20 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:c9bae4933c711d664e15da5b98e6e057fda51697aef4f3ec8e932922aa969373

      (For s390x architecture)
      The image digest is sha256:24efd2a05ad0aaff7f303ec7aceef23fbf2495c5bb122a2a177d69d51a18376a

      (For ppc64le architecture)
      The image digest is sha256:aa79662c0220879c8cde3314199265de32d0b6c420377f7ba9ed322f4657ce1c

      (For aarch64 architecture)
      The image digest is sha256:be52c63b0a81cb4a29f40f1a4554e6f11874d929d5c1a5f6f5fbcb3869525bf2

All OpenShift Container Platform 4.20 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.