In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libssh2 | Nov 8, 2019 | Oct 21, 2019 |
| Amazon Linux Ami 2 | — | Upgrade libssh2Upgrade libssh2-debuginfoUpgrade libssh2-develUpgrade libssh2-docs | Oct 28, 2020 | Oct 21, 2019 |
| Centos_linux | — | Upgrade libssh2-develUpgrade libssh2Upgrade libssh2-docsUpgrade libssh2-debuginfo | Oct 1, 2020 | Oct 21, 2019 |
| Debian | — | Upgrade libssh2 | Nov 14, 2019 | Oct 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libssh2 | Dec 4, 2019 | Oct 21, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libssh2 | Dec 18, 2019 | Oct 21, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libssh2 | Dec 11, 2019 | Oct 21, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libssh2 | Nov 28, 2019 | Oct 21, 2019 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle Solaris | — | Upgrade library/libssh2 to version 1.9.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Oct 21, 2019 |
| Oracle_linux | — | Upgrade libssh2Upgrade libssh2-develUpgrade libssh2-docs | Oct 9, 2020 | Oct 16, 2019 |
| Redhat_linux | — | Upgrade libssh2No solution existsUpgrade libssh2-develUpgrade libssh2-docsUpgrade libssh2-debuginfo | Oct 1, 2020 | Oct 21, 2019 |
| Suse | — | Upgrade libssh2-1-32bitUpgrade libssh2-develUpgrade libssh2-1 | Nov 7, 2019 | Oct 21, 2019 |
| Ubuntu | — | Upgrade libssh2-1 (Ubuntu Pro) | Mar 22, 2023 | Oct 21, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub