CVE-2020-14145

Vulnerability

CVE-2020-14145 is an observable discrepancy in the client-side algorithm negotiation of OpenSSH versions 5.7 through 8.4 (and possibly 8.5 and 8.6 according to some reports) [1][4]. The vulnerability allows an attacker to infer the preferred host key algorithm of the client by observing the order in which the client proposes algorithms during the SSH handshake. This occurs only when the client has no cached host key for the server (i.e., during initial connection attempts) [1][3].

Exploitation

To exploit this vulnerability, an attacker must be in a position to conduct a man-in-the-middle (MITM) attack on the SSH connection [1]. The attacker needs to intercept the initial SSH handshake where the client sends its algorithm proposals. By observing the order of host key algorithms in the client's proposal, the attacker can determine which algorithm the client prefers. The attacker does not need to authenticate or have any special privileges; network access to the connection path is sufficient [1][3].

Impact

Successful exploitation leads to information disclosure: the attacker learns the client's preferred host key algorithm, which could aid in further attacks, such as downgrading the connection to a weaker algorithm or targeting specific key types [1][3]. This information leak is limited to the algorithm preference and does not directly allow impersonation, code execution, or data manipulation. However, it weakens the security of the initial key verification process, especially when no trusted host key is cached [1][3].

Mitigation

A partial mitigation was included in OpenSSH 8.4 via commit b3855ff053f5078ec3d3c653cdaedefaa5fc362d, which adjusts the algorithm ordering when the client has a key matching the default best-preference algorithm [2][3]. The Gentoo GLSA 202105-35 recommends upgrading to OpenSSH 8.5_p1 or later [4]. Users should ensure they are running a patched version (≥8.4) and consider employing known_hosts pinning or SSHFP records to reduce the risk of MITM attacks on first connection [3][4].