CVE-2019-3861

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

References

Affected packages

Git / github.com/libssh2/libssh2

Affected ranges

Type

GIT

Repo

https://github.com/libssh2/libssh2

Events

Introduced

74b12c3c7adaab4ab22f0284672dd95a573664b6

Last affected

30e9c1347e3b8baa2951db612f05e6d87fc8e2f2

Database specific

{
    "versions": [
        {
            "introduced": "0.15"
        },
        {
            "last_affected": "1.8.0"
        }
    ]
}

Affected versions

RELEASE.*

RELEASE.0.15

RELEASE.0.16

RELEASE.0.17

RELEASE.0.18

RELEASE.1.0

RELEASE.1.1

libssh2-1.*

libssh2-1.2

libssh2-1.2.1

libssh2-1.2.2

libssh2-1.2.3

libssh2-1.2.4

libssh2-1.2.5

libssh2-1.2.6

libssh2-1.2.7

libssh2-1.2.8

libssh2-1.2.9

libssh2-1.3.0

libssh2-1.4.0

libssh2-1.4.1

libssh2-1.4.2

libssh2-1.4.3

libssh2-1.5.0

libssh2-1.6.0

libssh2-1.7.0

libssh2-1.8.0

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "15.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "42.3"
            }
        ]
    }
]

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-3861.json"