CVE-2015-1782
published 2015-03-13CVE-2015-1782: The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted…
PriorityP428medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
3.50%
87.9th percentile
The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | libssh2 | < libssh2 1.4.3-4.1 (bookworm) | libssh2 1.4.3-4.1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| libssh2 | libssh2 | <= 1.4.3 | — |
| libssh2 | libssh2 | >= 0 < 1.4.3-4.1 | 1.4.3-4.1 |
| libssh2 | libssh2 | >= 0 < 1.4.3-4.1 | 1.4.3-4.1 |
| libssh2 | libssh2 | >= 0 < 1.4.3-4.1 | 1.4.3-4.1 |
| libssh2 | libssh2 | >= 0 < 1.4.3-4.1 | 1.4.3-4.1 |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_debian6.8MEDIUM
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-47g3-jvrj-pm9m: The kex_agree_methods function in libssh2 before 1
ghsa_unreviewed·2022-05-17
CVE-2015-1782 [MEDIUM] CWE-20 GHSA-47g3-jvrj-pm9m: The kex_agree_methods function in libssh2 before 1
The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet.
OSV
CVE-2015-1782: The kex_agree_methods function in libssh2 before 1
osv·2015-03-13·CVSS 6.8
CVE-2015-1782 [MEDIUM] CVE-2015-1782: The kex_agree_methods function in libssh2 before 1
The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet.
Red Hat
libssh2: Using SSH_MSG_KEXINIT data unbounded
vendor_redhat·2015-03-11·CVSS 6.8
CVE-2015-1782 [MEDIUM] CWE-130 libssh2: Using SSH_MSG_KEXINIT data unbounded
libssh2: Using SSH_MSG_KEXINIT data unbounded
The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet.
A flaw was found in the way the kex_agree_methods() function of libssh2 performed a key exchange when negotiating a new SSH session. A man-in-the-middle attacker could use a crafted SSH_MSG_KEXINIT packet to crash a connecting libssh2 client.
Package: libssh2 (Red Hat Enterprise Linux 6) - Will not fix
Debian
CVE-2015-1782: libssh2 - The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to ...
vendor_debian·2015·CVSS 6.8
CVE-2015-1782 [MEDIUM] CVE-2015-1782: libssh2 - The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to ...
The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet.
Scope: local
bookworm: resolved (fixed in 1.4.3-4.1)
bullseye: resolved (fixed in 1.4.3-4.1)
forky: resolved (fixed in 1.4.3-4.1)
sid: resolved (fixed in 1.4.3-4.1)
trixie: resolved (fixed in 1.4.3-4.1)
No detection rules found.
No public exploits indexed.
HackerOne
SSRF in https://imgur.com/vidgif/url
hackerone·2016-03-12
SSRF in https://imgur.com/vidgif/url
SSRF in https://imgur.com/vidgif/url
Hello,
Short description
https://imgur.com/vidgif/url endpoint is vulnerable to a SSRF vulnerability which allows an attacker to craft connections originating from imgur servers to any destination on the internet and imgur internal network and craft outgoing UDP-packets / telnet-based protocol sessions (for example, to connect to SMTP servers from imgur and send spam).
Why does the vulnerability exist?
imgur allows users to use 'video-to-gif' service. When a user requests conversion of such a video, imgur's servers perform an HTTP request to a user-supplied URL in order to discover the URL-s content-type and length. It is evident that in order to do so imgur utilizes libcurl. However, imgur does not properly validate user input and does not configu
Bugzilla
CVE-2015-1782 libssh2: Using SSH_MSG_KEXINIT data unbounded
bugzilla·2015-03-06·CVSS 6.8
CVE-2015-1782 [MEDIUM] CVE-2015-1782 libssh2: Using SSH_MSG_KEXINIT data unbounded
CVE-2015-1782 libssh2: Using SSH_MSG_KEXINIT data unbounded
The following issue was reported as affecting libssh2:
When negotiating a new SSH session with a remote server, one of libssh2's
functions for doing the key exchange (kex_agree_methods) was naively reading
data from the incoming packet and using it without doing sufficient range
checks. The SSH_MSG_KEXINIT packet arrives to libssh2 with a set of strings,
sent as a series of LENGTH + DATA pairs. libssh2 would go through the list and
read the LENGTH field, read the string following the LENGTH and then advance
the pointer LENGTH bytes in memory and expect to find the next LENGTH + DATA
pair there. Then move on until seven subsequent strings are taken care of. It
would naively assume that the (unsigned 32 bit) LENGTH fields were fin
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151943.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-March/152362.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-March/153933.htmlhttp://www.debian.org/security/2015/dsa-3182http://www.libssh2.org/adv_20150311.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2015:148http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlhttp://www.securityfocus.com/bid/73061http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151943.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-March/152362.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-March/153933.htmlhttp://www.debian.org/security/2015/dsa-3182http://www.libssh2.org/adv_20150311.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2015:148http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlhttp://www.securityfocus.com/bid/73061
2015-03-13
Published