CVE-2025-4878

What it actually does

Uninitialized variable in libssh privatekey_from_file() when the specified filename does not exist, resulting in possible signing failures or heap corruption under MemoryCorruption conditions.

Why it matters to the business

May cause SSH-related operations in affected software such as PostgreSQL deployments to fail or crash, leading to disrupted secure connections and requiring urgent patching in environments using the vulnerable library.

How an attack unfolds

An attacker with local access supplies a non-existent filename to trigger privatekey_from_file(), exploiting the uninitialized variable to induce heap corruption or signing errors; low EPSS and no KEV or ransomware association indicate limited real-world exploitation despite a modest 23% EPSS rise over 30 days.

How to fix it

Upgrade postgresql (Bitnami) to version 13.22.0 or later; rebuild or update any downstream packages that embed the vulnerable libssh version.

How to confirm the fix worked

Verify the installed postgresql (Bitnami) version is at least 13.22.0; test privatekey_from_file() behavior with deliberately missing files to confirm absence of corruption or signing anomalies.

Typical attack path

1. Obtain local access to the target system
2. Identify or induce a call to privatekey_from_file() with a non-existent key file path
3. Trigger the uninitialized variable condition to cause heap corruption or signing failure

How to detect it

Review application logs for unexpected SSH signing failures or heap-related crashes when key files are referenced; correlate with local process execution attempting to load non-existent private keys.

What your security team should do

• Immediately upgrade postgresql (Bitnami) to 13.22.0 across all instances
• Scan for other applications using vulnerable libssh versions and prioritize updates
• Monitor EPSS trend and reassess exploit maturity as new data emerges