Information Leak in OpenSSH Client Leading to Potential Man-in-the-Middle Attacks

CVE-2020-14145

Summary

OpenSSH clients from versions 5.7 to 8.4 exhibit a vulnerability that allows an observable discrepancy during the algorithm negotiation phase. This flaw could be exploited by an attacker implementing man-in-the-middle tactics, specifically targeting initial connection attempts before any host key for the server has been cached by the client. Some reports suggest potential impacts extend to versions 8.5 and 8.6 as well.

References