CVE search · CVE-2019-17498
CVE-2019-17498
high 8.1
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.
Details
- Status
- Modified
- Published
- Last changed
- Source
- cve@mitre.org
- Weakness
- CWE-190
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | high 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H |
nvd@nist.govPrimary |
| CVSS 2.0 | medium 5.8 | AV:N/AC:M/Au:N/C:P/I:N/A:P |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- libssh2 · libssh2
- fedoraproject · fedora
- opensuse · leap
- debian · debian_linux
- netapp · active_iq_unified_manager
- netapp · element_software
- netapp · hci_management_node
- netapp · ontap_select_deploy_administration_utility
- netapp · solidfire
- netapp · bootstrap_os
References
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.htmlMailing ListThird Party Advisory
- http://packetstormsecurity.com/files/172835/libssh2-1.9.0-Out-Of-Bounds-Read.html
- https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/Broken Link
- https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498ExploitThird Party Advisory
- https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480ExploitThird Party Advisory
- https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9cPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/11/msg00010.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/12/msg00013.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22H4Q5XMGS3QNSA7OCL3U7UQZ4NXMR5O/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/
- https://security.netapp.com/advisory/ntap-20220909-0004/Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.htmlMailing ListThird Party Advisory
- http://packetstormsecurity.com/files/172835/libssh2-1.9.0-Out-Of-Bounds-Read.html
- https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/Broken Link
- https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498ExploitThird Party Advisory
- https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480ExploitThird Party Advisory
- https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9cPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/11/msg00010.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/12/msg00013.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22H4Q5XMGS3QNSA7OCL3U7UQZ4NXMR5O/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/
- https://security.netapp.com/advisory/ntap-20220909-0004/Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html