CVE-2019-3856High· 8.8▾ TwilightAn integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on th…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 1.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
6.1%
An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.
libssh2 < 1.8.1debian_linux = 8.0debian_linux = 9.0ontap_select_deploy_administration_utilityleap = 15.0leap = 42.3enterprise_linux = 8.0enterprise_linux_desktop = 7.0enterprise_linux_server = 7.0enterprise_linux_server_aus = 7.6enterprise_linux_server_eus = 7.6enterprise_linux_server_tus = 7.6enterprise_linux_workstation = 7.0fedora = 28peoplesoft_enterprise_peopletools = 8.56peoplesoft_enterprise_peopletools = 8.57Upgrade past the affected range:
libssh2 1.8.1Connected by shared product, vendor, weakness, or advisory.
CVE-2019-3857High· 8.8An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed
CVE-2019-3855High· 8.8An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server
CVE-2019-3863High· 7.5A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side
CVE-2019-3860Medium· 5.0An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed
CVE-2019-3861Medium· 5.0An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed
CVE-2019-3862High· 7.3An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed