DEBIAN-CVE-2019-13115
- Source
- https://security-tracker.debian.org/tracker/CVE-2019-13115
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2019-13115.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2019-13115
- Upstream
- Published
- 2019-07-16T18:15:13Z
- Modified
- 2025-09-19T06:22:35Z
- Summary
- [none]
- Details
-
In libssh2 before 1.9.0, kexmethoddiffiehellmangroupexchangesha256keyexchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an libssh2check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.
- References
Affected packages
Debian:11 / libssh2
Package
- Name
- libssh2
- Purl
- pkg:deb/debian/libssh2?arch=source
Debian:12 / libssh2
Package
- Name
- libssh2
- Purl
- pkg:deb/debian/libssh2?arch=source
Debian:13 / libssh2
Package
- Name
- libssh2
- Purl
- pkg:deb/debian/libssh2?arch=source
Debian:14 / libssh2
Package
- Name
- libssh2
- Purl
- pkg:deb/debian/libssh2?arch=source