p PatchFirst

CVE-2019-3860

CVE-2019-3860

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

CVSS 5.0 · Medium · EPSS 5.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libssh2

    Versions
    • 1.8.1: Affected

    No fix published

  • libssh2 Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.8.0-2.1

    Update to 1.8.0-2.1

  • libssh2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.8.0-2.1

    Update to 1.8.0-2.1

  • libssh2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.8.0-2.1

    Update to 1.8.0-2.1

  • libssh2 Ubuntu:Pro:14.04:LTS

    Versions
    • 1.4.3-1
    • 1.4.3-2
    • 1.4.3-2ubuntu0.1
    • 1.4.3-2ubuntu0.2
    • 1.4.3-2ubuntu0.2+esm1
    Affected ranges
    • ECOSYSTEM: < 1.4.3-2ubuntu0.2+esm2

    Update to 1.4.3-2ubuntu0.2+esm2

  • libssh2 Ubuntu:Pro:16.04:LTS

    Versions
    • 1.5.0-2
    • 1.5.0-2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 1.5.0-2ubuntu0.1+esm1

    Update to 1.5.0-2ubuntu0.1+esm1

  • libssh2 Ubuntu:Pro:18.04:LTS

    Versions
    • 1.8.0-1
    • 1.8.0-1ubuntu0.1
    • 1.8.0-1ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →