CVE-2025-14821

Name	CVE-2025-14821
Description	A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an insecure default configuration on Windows systems where the library automatically loads configuration files from the C:\etc directory, which can be created and modified by unprivileged local users.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libssh (PTS)	bullseye	0.9.8-0+deb11u1	fixed
	bullseye (security)	0.9.8-0+deb11u2	fixed
	bookworm	0.10.6-0+deb12u2	fixed
	bookworm (security)	0.10.6-0+deb12u1	fixed
	trixie	0.11.2-1+deb13u1	fixed
	forky, sid	0.12.0-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libssh	source	(unstable)	(not affected)

- libssh <not-affected> (Only affects libssh on Windows)
https://www.libssh.org/security/advisories/CVE-2025-14821.txt