CVE-2019-3857: Integer Overflow
A server could send a SSHMSGCHANNELREQUEST packet with an exit signal message with a length of max unsigned integer value. The length would then have a value of 1 added to it and used to allocate memory causing a possible memory write out of bounds error or zero byte allocation.
Other sources
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSHMSGCHANNELREQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-3857?
CVE-2019-3857 is an integer overflow vulnerability discovered in libssh2 before 1.8.1.
What is the severity of CVE-2019-3857?
CVE-2019-3857 has a severity level of 8.8 (high).
How does CVE-2019-3857 impact the affected software?
CVE-2019-3857 could lead to an out of bounds write in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed, potentially allowing a remote attacker to execute code on the client system.
Which versions of libssh2 are affected by CVE-2019-3857?
Versions of libssh2 before 1.8.1 are affected by CVE-2019-3857.
How can I fix CVE-2019-3857?
To fix CVE-2019-3857, you should update libssh2 to version 1.8.1 or later.