Out of Bounds Read Vulnerability in libssh2: Potential Denial of Service Risk
Summary
UBUNTU-CVE-2019-3861: An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. Affects libssh2 versions < 1.4.3-2ubuntu0.2+esm2. Fixed in 1.4.3-2ubuntu0.2+esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libssh2 is a widely-used library that implements the SSH2 protocol, allowing secure communication over unsecured networks. It provides functionalities for secure file transfers, remote command execution, and secure shell access. The library is integral for applications requiring secure data transmission. However, it has been found vulnerable to an out of bounds read flaw, which can be exploited by attackers.
Vulnerability Detail
An out of bounds read flaw was discovered in libssh2 versions prior to 1.8.1. This vulnerability arises from the improper parsing of SSH packets that have a padding length value greater than the actual packet length. A remote attacker who compromises an SSH server could exploit this flaw to cause a Denial of Service (DoS) or potentially read sensitive data from the client’s memory. The vulnerability is classified with a CVSS score of 5.0, indicating a medium severity level.
How To Fix
Minimum fixed version
1.4.3-2ubuntu0.2+esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libssh2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to limit access to the SSH server and monitor for any unusual activity until the package can be updated. Additionally, consider using firewall rules to restrict access to trusted IP addresses only.
Conclusion
The out of bounds read vulnerability in libssh2 poses a significant risk, allowing attackers to exploit the flaw for Denial of Service or data exposure. It is crucial for users to update their libssh2 packages to the latest patched versions to mitigate these risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for libssh2 →
FAQ
The vulnerability can lead to Denial of Service attacks and potential exposure of sensitive data from the client’s memory.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions of libssh2 prior to 1.8.1 are affected by this vulnerability.
Yes, a patched version of libssh2 is available. Users should update to version 1.8.1 or later.
Vulert monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json. It provides real-time alerts for vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for libssh2.
