CVE-2019-3859: Critical severity libssh2 libssh2 vulnerability
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the libssh2packetrequire and libssh2packetrequirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libssh2to a version that resolves this vulnerability.Fixed in 1.8.0-2.1Fixed in 1.8.0-2.1+deb10u1Fixed in 1.9.0-2Fixed in 1.10.0-3Fixed in 1.11.0-2
Event History
Frequently Asked Questions
What is CVE-2019-3859?
CVE-2019-3859 is a vulnerability found in libssh2 before version 1.8.1.
What is the severity of CVE-2019-3859?
The severity of CVE-2019-3859 is critical with a CVSS score of 9.1.
How does CVE-2019-3859 affect libssh2?
CVE-2019-3859 can cause an out of bounds read on the _libssh2_packet_require and _libssh2_packet_requirev functions in libssh2.
What is the impact of CVE-2019-3859?
An attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
How can CVE-2019-3859 be fixed?
To fix CVE-2019-3859, users should upgrade to libssh2 version 1.8.1 or later.