Vulnerability Description
A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Libssh2 | Libssh2 | < 1.8.1 |
| Debian | Debian Linux | 8.0 |
| Netapp | Ontap Select Deploy Administration Utility | - |
| Opensuse | Leap | 15.0 |
| Redhat | Enterprise Linux Desktop | 7.0 |
| Redhat | Enterprise Linux Server | 7.0 |
| Redhat | Enterprise Linux Server Aus | 7.6 |
| Redhat | Enterprise Linux Server Eus | 7.6 |
| Redhat | Enterprise Linux Server Tus | 7.6 |
| Redhat | Enterprise Linux Workstation | 7.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.htmlThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0679Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1175
- https://access.redhat.com/errata/RHSA-2019:1652
- https://access.redhat.com/errata/RHSA-2019:1791
- https://access.redhat.com/errata/RHSA-2019:1943
- https://access.redhat.com/errata/RHSA-2019:2399
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3863Issue TrackingPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/03/msg00032.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://seclists.org/bugtraq/2019/Apr/25
- https://security.netapp.com/advisory/ntap-20190327-0005/Third Party Advisory
- https://www.debian.org/security/2019/dsa-4431
- https://www.libssh2.org/CVE-2019-3863.htmlPatchVendor Advisory
FAQ
What is CVE-2019-3863?
CVE-2019-3863 is a vulnerability with a CVSS score of 7.5 (HIGH). A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsi...
How severe is CVE-2019-3863?
CVE-2019-3863 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-3863?
Check the references section above for vendor advisories and patch information. Affected products include: Libssh2 Libssh2, Debian Debian Linux, Netapp Ontap Select Deploy Administration Utility, Opensuse Leap, Redhat Enterprise Linux Desktop.