CVE-2020-14145: Medium severity IBM Security Guardium Insights vulnerability
OpenSSH is vulnerable to a man-in-the-middle attack, caused by an observable discrepancy flaw. An attacker could exploit this vulnerability to launch a man-in-the-middle attack and gain access to the communication channel between endpoints to obtain sensitive information or further compromise the system.
Other sources
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-14145?
CVE-2020-14145 is a vulnerability in OpenSSH that allows man-in-the-middle attackers to target initial connection attempts.
How severe is CVE-2020-14145?
CVE-2020-14145 has a severity rating of 5.9 (medium).
How does CVE-2020-14145 affect OpenSSH versions?
CVE-2020-14145 affects OpenSSH versions 5.7 through 8.4.
Is IBM Security Guardium Insights affected by CVE-2020-14145?
Yes, IBM Security Guardium Insights version 2.0.2 is affected by CVE-2020-14145.
How can I fix CVE-2020-14145 in OpenSSH?
To fix CVE-2020-14145 in OpenSSH, you should update to a version higher than 8.4.