CVE-2015-1782 — Improper Input Validation in Libssh2

CWE-20 — Improper Input ValidationCWE-130 — Improper Handling of Length Parameter Inconsistency8 documents8 sources
Severity
6.8MEDIUMNVD
EPSS
4.1%
top 11.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Libssh2Debian LinuxFedoraproject Fedora
Timeline
PublishedMar 13
Latest updateMay 17

Description

The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages2 packages

▶Debianlibssh2/libssh2< 1.4.3-4.1+3
▶NVDlibssh2/libssh21.4.3

Also affects: Debian Linux 7.0, Fedora 20, 21, 22

🔴Vulnerability Details

3
GHSA
GHSA-47g3-jvrj-pm9m: The kex_agree_methods function in libssh2 before 1↗2022-05-17
▶
CVEList
CVE-2015-1782: The kex_agree_methods function in libssh2 before 1↗2015-03-13
▶
OSV
CVE-2015-1782: The kex_agree_methods function in libssh2 before 1↗2015-03-13
▶

📋Vendor Advisories

2
Red Hat
libssh2: Using SSH_MSG_KEXINIT data unbounded↗2015-03-11
▶
Debian
CVE-2015-1782: libssh2 - The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to ...↗2015
▶

💬Community

2
HackerOne
SSRF in https://imgur.com/vidgif/url↗2016-03-12
▶
Bugzilla
CVE-2015-1782 libssh2: Using SSH_MSG_KEXINIT data unbounded↗2015-03-06
▶