SSH.NET Project SSH.NET 2020.0.1 for .NET
Approved changes feed: RSS · Atom
cpe:2.3:a:ssh.net_project:ssh.net:2020.0.1:*:*:*:*:.net:*:*part: a version: 2020.0.1 update: *
| Vendor | Ssh.Net Project (e7948415-3aab-58c3-9dd1-e497c4259d90) |
|---|---|
| Product | Ssh.Net (b7acc2d5-5f12-585d-a086-44295bb5a804) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | .net |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/sshnet/ssh.net |
purl2cpe | 2026-06-01 10:13:14.925787 |
pkg:nuget/SSH.NET |
purl2cpe | 2026-06-01 10:13:14.925788 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-29245 |
vulnerable | 2026-06-08 05:42:47.409520 |
Weak private key generation in SSH.NET
MEDIUM (6.5)
SSH.NET is a Secure Shell (SSH) library for .NET. In versions 2020.0.0 and 2020.0.1, during an `X25519` key exchange, the client’s private key is generated with `System.Random`. `System.Random` is not a cryptographically secure random number generator, it must therefore not be used for cryptographic purposes. When establishing an SSH connection to a remote host, during the X25519 key exchange, the private key is generated with a weak random number generator whose seed can be brute forced. This allows an attacker who is able to eavesdrop on the communications to decrypt them. Version 2020.0.2 contains a patch for this issue. As a workaround, one may disable support for `curve25519-sha256` and `curve25519-sha256@libssh.org` key exchange algorithms.
Published: 2022-05-31T16:35:11.000Z
Updated: 2025-04-22T17:55:45.721Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.