CVE-2019-3860: Critical severity libssh2 libssh2 vulnerability
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libssh2to a version that resolves this vulnerability.Fixed in 1.8.0-2.1Fixed in 1.8.0-2.1+deb10u1Fixed in 1.9.0-2Fixed in 1.10.0-3Fixed in 1.11.0-2
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-3860.
What is the severity of CVE-2019-3860?
The severity of CVE-2019-3860 is critical, with a severity value of 9.1.
What is the affected software for CVE-2019-3860?
The affected software for CVE-2019-3860 includes libssh2 before version 1.8.1, Debian Linux version 8.0, NetApp ONTAP Select Deploy administration utility, and openSUSE Leap versions 15.0 and 42.3.
How can the vulnerability CVE-2019-3860 be exploited?
An attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
Is there a fix available for CVE-2019-3860?
Yes, the fix for CVE-2019-3860 is to upgrade libssh2 to version 1.8.1 or later.