CVE-2025-4877: Libssh: write beyond bounds in binary to base64 conversion functions
bintobase64() (src/base64.c) can experience an integer overflow and subsequent under allocation, leading to a write beyond bounds. The bug can occur only in 32-bit builds. The only problematic use case is sshgetfingerprinthash() in case the API is (mis)used and a libssh consumer passes in an unexpectedly large input buffer. As a mitigation, the function bintobase64() is adjusted to not allow inputs larger than 256MB, which is aligned with other functions that process user input.
Other sources
There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to sshgetfingerprinthash() function. In such cases the bintobase64() function can experience an integer overflow leading to a memory under allocation, when that happens it's possible that the program perform out of bounds write leading to a heap corruption. This issue affects only 32-bits builds of libssh.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/libsshto a version that resolves this vulnerability.Fixed in 0.11.2-r0 - Upgrade
Upgrade
debian/libsshto a version that resolves this vulnerability.Fixed in 0.10.6-0+deb12u2 - Upgrade
Upgrade
debian/libsshto a version that resolves this vulnerability.Fixed in 0.11.2-1 - Upgrade
Upgrade
debian/libsshto a version that resolves this vulnerability.Fixed in 0.10.6-0+deb12u2Fixed in 0.10.6-0+deb12u3Fixed in 0.11.5-0+deb13u1Fixed in 0.12.2-1 - Configuration
Adjust bin_to_base64() so it rejects/does not accept inputs larger than 256MB to prevent the integer overflow that can cause a heap corruption (issue affects 32-bit builds).
libssh (src/base64.c) function bin_to_base64() maximum allowed input size for bin_to_base64() = 256MB - Compensating control
On 32-bit builds, avoid the (mis)use of ssh_get_fingerprint_hash() by ensuring the input buffer passed to ssh_get_fingerprint_hash() is not unexpectedly large (since this is the only problematic use case described).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4877?
CVE-2025-4877 has been classified with a severity level that indicates potential for significant impact primarily due to integer overflow leading to buffer overflows.
How do I fix CVE-2025-4877?
To fix CVE-2025-4877, ensure you update to the latest version of libssh that addresses the integer overflow vulnerability.
Which software versions are affected by CVE-2025-4877?
CVE-2025-4877 specifically affects 32-bit builds of libssh that utilize the bin_to_base64() function.
What are the potential consequences of CVE-2025-4877?
The potential consequences of CVE-2025-4877 include memory corruption and unauthorized access due to write beyond bounds.
Is CVE-2025-4877 a critical vulnerability?
CVE-2025-4877 is considered critical in scenarios where the affected functions are exploited as it can lead to serious security breaches.