CVE-2016-0787

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.7.0

Description The issue arises from a "bits/bytes confusion bug" in the diffie hellman sha256 function, which improperly truncates secrets to 128 or 256 bits. This makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions.

Recommendations For versions prior to 1.7.0, update to version 1.7.0 or later to resolve the issue. As a temporary workaround, consider restricting SSH sessions to minimize the risk of exploitation.