CVE-2019-13115 — Out-of-bounds Read in Libssh2

CWE-125 — Out-of-bounds ReadCWE-190 — Integer Overflow or WraparoundCWE-787 — Out-of-bounds Write10 documents8 sources
Severity
8.1HIGHNVD
EPSS
42.8%
top 2.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Libssh2F5 Traffix Systems Signaling Delivery ControllerNetapp E-series Santricity OS Controller+2 more
Timeline
PublishedJul 16
Latest updateMay 24

Description

In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:HExploitability: 2.8 | Impact: 5.2

Affected Packages5 packages

▶NVDlibssh2/libssh2< 1.9.0
▶Debianlibssh2/libssh2< 1.9.0-1+3
▶Ubuntulibssh2/libssh2< 1.5.0-2ubuntu0.1+esm1

Also affects: Debian Linux 8.0, 9.0, Fedora 29, 30

🔴Vulnerability Details

4
GHSA
GHSA-98vm-qgxx-5rjm: In libssh2 before 1↗2022-05-24
▶
OSV
libssh2 vulnerabilities↗2022-03-07
▶
CVEList
CVE-2019-13115: In libssh2 before 1↗2019-07-16
▶
OSV
CVE-2019-13115: In libssh2 before 1↗2019-07-16
▶

📋Vendor Advisories

3
Ubuntu
libssh2 vulnerabilities↗2022-03-07
▶
Red Hat
libssh2: integer overflow in kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c leads to out-of-bounds write↗2019-07-16
▶
Debian
CVE-2019-13115: libssh2 - In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exc...↗2019
▶

💬Community

2
Bugzilla
CVE-2019-13115 libssh2: integer overflow in kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c leads to out-of-bounds write↗2019-07-19
▶
Bugzilla
CVE-2019-13115 libssh2: integer overflow in kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c leads to out-of-bounds write [fedora-all]↗2019-07-19
▶
CVE-2019-13115 — Out-of-bounds Read in Libssh2 | cvebase