Integer Overflow Vulnerability in libssh2: Potential Out-of-Bounds Read Risk
Summary
ALPINE-CVE-2019-13115: In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. Affects libssh2 versions < 1.9.0-r0. Fixed in 1.9.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libssh2 is a widely used C library that implements the SSH2 protocol, allowing secure communication over unsecured networks. It is commonly utilized in applications requiring secure file transfers and remote command execution. The library's functionality includes key exchange, encryption, and authentication mechanisms. However, a vulnerability has been identified in versions prior to 1.9.0, which could lead to serious security risks.
Vulnerability Detail
In libssh2 versions before 1.9.0, the function kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c contains an integer overflow. This flaw can result in an out-of-bounds read when packets are processed from the server. A remote attacker who compromises an SSH server could exploit this vulnerability to disclose sensitive information or trigger a denial of service condition on the client system when a user connects to the server. This issue is related to an _libssh2_check_length mistake and is distinct from other vulnerabilities addressed in version 1.8.1, such as CVE-2019-3855.
How To Fix
Minimum fixed version
1.9.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade libssh2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the SSH server or implementing network-level controls to limit exposure to potential attacks. Additionally, monitor your systems for any unusual activity that may indicate exploitation attempts.
Conclusion
The integer overflow vulnerability in libssh2 poses significant risks to applications utilizing this library. It is crucial to update to the patched version 1.9.0-r0 or later to safeguard against potential exploits. Regular monitoring and using tools like Vulert can help maintain security in open-source software.
See every vulnerability recorded for libssh2 →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
All versions of libssh2 prior to 1.9.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to sensitive information disclosure or denial of service conditions on client systems.
Yes, you can restrict access to the SSH server and monitor for unusual activity as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for libssh2.
