ZeroDay Findings
Sign inSign up

Findings

CVE-2020-14145

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation.

Published Jun 29, 2020 · updated Oct 14, 2026 · openbsd openssh

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 29, 2020 · NIST NVD

    Detected

    The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

  2. Oct 14, 2026 · NIST NVD

    Updated

    The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

Affected

  • cpe netapp/active iq unified managerversion unspecified
  • cpe netapp/aff a700s firmwareversion unspecified
  • cpe netapp/hci management nodeversion unspecified
  • cpe netapp/ontap select deploy administration utilityversion unspecified
  • cpe openbsd/opensshversion unspecified
  • cpe openbsd/openssh8.4
  • cpe openbsd/openssh8.5
  • cpe openbsd/openssh8.6

Sources

  • CVE.orgVulnerability recordCVE-2020-14145

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2020-14145

    30-day exploitation probability 2.9%

    first.org
  • NIST NVDVulnerability recordCVE-2020-14145

    The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NO

    nvd.nist.gov

References