CVE-2016-0787
libssh2: bits/bytes confusion resulting in truncated Diffie-Hellman secret length
Severity
ModerateRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · February 23, 2016
Updated · November 21, 2025
Description
A type confusion issue was found in the way libssh2 generated ephemeral secrets for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This would cause an SSHv2 Diffie-Hellman handshake to use significantly less secure random parameters.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 5.8AV:N/AC:M/Au:N/C:P/I:P/A:N
CWE-704 · Incorrect Type Conversion or Cast