GHSA-q7pc-356p-hggc: Out-of-bounds Read
Summary
A flaw in the SSH service allows an authenticated client to crash the server by sending a malformed protocol message while opening a channel.
Impact
Any user able to authenticate over SSH can trigger an unhandled error condition that aborts the server process. This results in a denial of service affecting all connected users until the service is restarted. No confidentiality or integrity impact has been identified; the issue is limited to availability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/drakkan/sftpgo/v2to a version that resolves this vulnerability.Fixed in 2.7.5
Event History
Frequently Asked Questions
Who can exploit this issue?
Any user who can successfully authenticate to the SSH service can trigger the crash. The provided information does not indicate that unauthenticated network clients can exploit it.
What does an attacker need to do to cause an outage?
The attacker must send a malformed SSH protocol message while opening a channel. Exploitation does not require user interaction and can abort the server process.
What is the operational impact of a successful exploit?
The SSH service stops, disrupting all connected users until it is restarted. The available information identifies no confidentiality or integrity impact.
How can I determine whether my deployment may be exposed?
Determine whether your SFTPGo v2 deployment has an SSH service reachable by users who can authenticate. The supplied data does not include affected or fixed version ranges.