CVE-2020-14145
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation.
Published Jun 29, 2020 · updated Oct 14, 2026 · openbsd openssh
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.
Timeline
Detection, updates, and resolution for this record.
Jun 29, 2020 · NIST NVD
Detected
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.
Oct 14, 2026 · NIST NVD
Updated
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.
Affected
- cpe netapp/active iq unified managerversion unspecified
- cpe netapp/aff a700s firmwareversion unspecified
- cpe netapp/hci management nodeversion unspecified
- cpe netapp/ontap select deploy administration utilityversion unspecified
- cpe openbsd/opensshversion unspecified
- cpe openbsd/openssh8.4
- cpe openbsd/openssh8.5
- cpe openbsd/openssh8.6
Sources
- CVE.orgCVE-2020-14145
Official CVE identifier
cve.org - NIST NVDCVE-2020-14145
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NO
nvd.nist.gov