CVE-2019-3859 Information disclosure in libssh2

Medium 5.0 Published 20 Mar 2019 Updated 14 Oct 2026

A remote attacker compromising an SSH server can cause a denial of service or read client memory via an out-of-bounds read in libssh2.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-3859?

CVE-2019-3859 is a medium-severity vulnerability in Debian Debian Linux, published on 20 Mar 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

Weakness: CWE-125

Which versions are affected by CVE-2019-3859?

It affects 5 products.

Linux distribution packages (20)

`libssh2_org` SUSE:Enterprise Storage 4	All versions	`1.4.3-20.6.1`
`libssh2_org` SUSE:Linux Enterprise Desktop 12 SP3	All versions	`1.4.3-20.6.1`
`libssh2_org` SUSE:Linux Enterprise Desktop 12 SP4	All versions	`1.4.3-20.6.1`
`libssh2_org` SUSE:Linux Enterprise Module for Basesystem 15	All versions	`1.8.0-4.6.1`
`libssh2_org` SUSE:Linux Enterprise Point of Sale 11 SP3	All versions	`1.2.9-4.2.12.8.1`
`libssh2_org` SUSE:Linux Enterprise Server 11 SP4-LTSS	All versions	`1.4.3-17.6.1`
`libssh2_org` SUSE:Linux Enterprise Server 12 SP1-LTSS	All versions	`1.4.3-20.6.1`
`libssh2_org` SUSE:Linux Enterprise Server 12 SP2-BCL	All versions	`1.4.3-20.6.1`
`libssh2_org` SUSE:Linux Enterprise Server 12 SP2-LTSS	All versions	`1.4.3-20.6.1`
`libssh2_org` SUSE:Linux Enterprise Server 12 SP3	All versions	`1.4.3-20.6.1`
`libssh2_org` SUSE:Linux Enterprise Server 12 SP4	All versions	`1.4.3-20.6.1`
`libssh2_org` SUSE:Linux Enterprise Server 12-LTSS	All versions	`1.4.3-20.6.1`
`libssh2_org` SUSE:Linux Enterprise Server for SAP Applications 12 SP1	All versions	`1.4.3-20.6.1`
`libssh2_org` SUSE:Linux Enterprise Server for SAP Applications 12 SP2	All versions	`1.4.3-20.6.1`
`libssh2_org` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	All versions	`1.4.3-20.6.1`
`libssh2_org` SUSE:Linux Enterprise Server for SAP Applications 12 SP4	All versions	`1.4.3-20.6.1`
`libssh2_org` SUSE:Linux Enterprise Software Development Kit 12 SP3	All versions	`1.4.3-20.6.1`
`libssh2_org` SUSE:Linux Enterprise Software Development Kit 12 SP4	All versions	`1.4.3-20.6.1`
`libssh2_org` SUSE:OpenStack Cloud 7	All versions	`1.4.3-20.6.1`
`libssh2_org` openSUSE:Leap 15.0	All versions	`1.8.0-lp150.3.6.1`

Products include Debian Debian Linux, Fedoraproject Fedora, Libssh2 Libssh2, Netapp Ontap Select Deploy Administration Utility, Opensuse Leap.

How do I fix CVE-2019-3859?

Upgrade to a fixed version.

Is CVE-2019-3859 being exploited?

There is no known exploitation of CVE-2019-3859 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2019-3859, DEBIAN-CVE-2019-3859, GHSA-3fjx-35vx-pq97, SUSE-SU-2019:1059-1, SUSE-SU-2019:1060-1, SUSE-SU-2019:14031-1 and 3 more.