CVE-2016-0787: Exposure of Sensitive Information to an Unauthorized Actor

April 13, 2016 (updated October 30, 2018)

The diffie_hellman_sha256 function in kex.c in libssh2 improperly truncates secrets to bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a “bits/bytes confusion bug.”

References

nvd.nist.gov/vuln/detail/CVE-2016-0787

Code Behaviors & Features

Detect and mitigate CVE-2016-0787 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →