OpenSSL Pseudo-Random Number Generator Vulnerability in Libssh

CVE-2014-0017

What is CVE-2014-0017?

The RAND_bytes function in Libssh versions prior to 0.6.3 contains a vulnerability related to the OpenSSL pseudo-random number generator. When forking is enabled, the state of the PRNG is not adequately reset, leading to shared state among child processes. This oversight creates a potential risk where local users could exploit a PID collision to gain unauthorized access to sensitive information, compromising system security.

References