Arbitrary Command Injection Vulnerability in libssh: CVE-2019-14889
Summary
ALPINE-CVE-2019-14889: A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. Affects libssh versions < 0.8.8-r0. Fixed in 0.8.8-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libssh is a C library that implements the SSH protocol, allowing secure communication between clients and servers. It provides functionalities such as secure file transfer and remote command execution. However, certain versions of libssh are vulnerable to an arbitrary command injection flaw, which can be exploited if user input is improperly handled.
Vulnerability Detail
A flaw was identified in the libssh API function ssh_scp_new() in versions prior to 0.9.3 and 0.8.8. When the libssh SCP client connects to a server, it executes the scp command with a user-provided path on the server-side. If the library is used in a manner where users can influence the third parameter of this function, an attacker could inject arbitrary commands, potentially compromising the remote target. This vulnerability has a CVSS score of 8.8, indicating a high severity risk.
How To Fix
Minimum fixed version
0.8.8-r0
This is the first release that contains the fix.
sudo apk add --upgrade libsshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider restricting user input to prevent manipulation of the third parameter in the ssh_scp_new() function. Implement input validation and sanitization to mitigate the risk of command injection.
Conclusion
CVE-2019-14889 is a significant vulnerability in the libssh library that can lead to arbitrary command execution on remote servers. It is crucial for users of affected versions to update to the patched versions or implement workarounds to mitigate the risk.
See every vulnerability recorded for libssh →
FAQ
CVE-2019-14889 is a vulnerability in the libssh library that allows for arbitrary command injection through improper handling of user input in the ssh_scp_new() function.
Versions of libssh prior to 0.9.3 and 0.8.8 are affected by this vulnerability.
An attacker could exploit this vulnerability to execute arbitrary commands on the remote server, leading to a compromise of the system.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
The CVSS score of CVE-2019-14889 is 8.8, indicating a high severity risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for libssh.
