Vulnerability Description
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Libssh2 | Libssh2 | < 1.8.1 |
| Fedoraproject | Fedora | 28 |
| Debian | Debian Linux | 8.0 |
| Netapp | Ontap Select Deploy Administration Utility | - |
| Redhat | Enterprise Linux | 8.0 |
| Redhat | Enterprise Linux Desktop | 7.0 |
| Redhat | Enterprise Linux Server | 7.0 |
| Redhat | Enterprise Linux Server Aus | 7.6 |
| Redhat | Enterprise Linux Server Eus | 7.6 |
| Redhat | Enterprise Linux Server Tus | 7.6 |
| Redhat | Enterprise Linux Workstation | 7.0 |
| Opensuse | Leap | 42.3 |
| Apple | Xcode | < 11.0 |
| Oracle | Peoplesoft Enterprise Peopletools | 8.56 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.htmlThird Party Advisory
- http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Third Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2019/Sep/42Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2019/03/18/3Mailing ListPatchThird Party Advisory
- http://www.securityfocus.com/bid/107485Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2019:0679Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1175Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1652Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1791Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1943Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2399Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3855Issue TrackingPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/03/msg00032.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2019-3855?
CVE-2019-3855 is a vulnerability with a CVSS score of 8.8 (HIGH). An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server m...
How severe is CVE-2019-3855?
CVE-2019-3855 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-3855?
Check the references section above for vendor advisories and patch information. Affected products include: Libssh2 Libssh2, Fedoraproject Fedora, Debian Debian Linux, Netapp Ontap Select Deploy Administration Utility, Redhat Enterprise Linux.