medium5.0
CVE-2019-3860
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed.
Impact
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Libssh2 | Libssh2 | from 0.3 through 1.8.0 |
| Debian | Debian Linux | Version 8.0 |
| Netapp | Ontap Select Deploy Administration Utility | All versions |
| Opensuse | Leap | Versions 15.0, 42.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00072.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3860
- https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html
- https://lists.debian.org/debian-lts-announce/2019/07/msg00028.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/
- https://seclists.org/bugtraq/2019/Apr/25
- https://security.netapp.com/advisory/ntap-20190327-0005/
- https://www.debian.org/security/2019/dsa-4431
- https://www.libssh2.org/CVE-2019-3860.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html