vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2020-14145

MEDIUM
5.9
CVSS Score
Published: June 29, 2020 at 05:33 PM UTC
Updated: October 14, 2026 at 10:17 AM UTC
9 products affected across 2 vendorsActive IQ Unified ManagerSteelstore Cloud Integrated StorageSolidfire· also runs on 1 platform

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.9
Exploit prediction
EPSS 3%
SSVC
No known exploit

Description

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Active IQ Unified Manager· NetAppnpm
95%
v ≥ 9.5
Aff A700S Firmware· NetApp
95%
All versions
netapp-aff-a700s (same device)
Hci Management Node· NetApp
95%
All versions
ONTAP Select Deploy administration utility· NetApp
95%
All versions
Solidfire· NetApp
95%
All versions
Steelstore Cloud Integrated Storage· NetApp
95%
All versions
OpenSSH· Openbsd
95%
5.7 ≤ v < 8.48.48.58.6
Affected range stops below 8.4, so it looks safe — our inference, not a vendor statement
Hci Compute Node· NetAppdevice
95%
All versions
Hci Storage Node· NetAppdevice
95%
All versions

Runs on — not affected

The affected product only carries this flaw when running on these platforms. The platforms themselves are not vulnerable.

References (9)

Mailing Listx_refsource_MLISTPatchThird Party Advisory
Source: [email protected]
http://www.openwall.com/lists/oss-security/2020/12/02/1
x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://anongit.mindrot.org/openssh.git/commit/?id=b3855ff053f5078ec3d3c653cdaedefaa5fc362d
x_refsource_MISCThird Party Advisory
Source: [email protected]
https://docs.ssh-mitm.at/CVE-2020-14145.html
x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/openssh/openssh-portable/compare/V_8_3_P1...V_8_4_P1
x_refsource_MISCThird Party Advisory
Source: [email protected]
https://github.com/ssh-mitm/ssh-mitm/blob/master/ssh_proxy_server/plugins/session/cve202014145.py
Vendor Advisoryx_refsource_GENTOOThird Party Advisory
Source: [email protected]
https://security.gentoo.org/glsa/202105-35
x_refsource_CONFIRMThird Party Advisory
Source: [email protected]
https://security.netapp.com/advisory/ntap-20200709-0004/
x_refsource_MISCThird Party Advisory
Source: [email protected]
https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.9MEDIUMCISA-ADP
Attack Vector
NETWORK
Complexity
HIGH
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-203

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card