UpHeron
All vulnerabilities

Servers and applications

CVE-2020-14145

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

Severity
Medium 5.9
Published
29 Jun 2020
Last changed
14 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
8.4
Sources
NVD

Affected software

SoftwareAffected versions
OpenSSHServers and applications · cpe:a:openbsd:openssh
  • From 5.7 before 8.4
  • Version 8.4
  • Version 8.5
  • Version 8.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-14145
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-14145