CVE-2019-3860 Information disclosure in libssh2
A remote attacker can cause denial of service or read client memory via out-of-bounds read in libssh2 SFTP packet parsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-3860?
CVE-2019-3860 is a medium-severity vulnerability in Debian Debian Linux, published on 25 Mar 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
Weakness: CWE-125
Which versions are affected by CVE-2019-3860?
It affects 4 products.
Linux distribution packages (27)
libssh2_org SUSE:Enterprise Storage 4 | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Enterprise Storage 5 | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:HPE Helion OpenStack 8 | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Desktop 12 SP4 | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Point of Sale 11 SP3 | All versions | 1.2.9-4.2.12.11.1 |
libssh2_org SUSE:Linux Enterprise Server 11 SP4-LTSS | All versions | 1.4.3-17.9.1 |
libssh2_org SUSE:Linux Enterprise Server 12 SP1-LTSS | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Server 12 SP2-LTSS | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Server 12 SP3 | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Server 12 SP3 | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Server 12 SP3-BCL | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Server 12 SP3-LTSS | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Server 12 SP3-LTSS | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Server 12 SP4 | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Server 12-LTSS | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:Linux Enterprise Software Development Kit 12 SP4 | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:OpenStack Cloud 7 | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:OpenStack Cloud 8 | All versions | 1.4.3-20.9.1 |
libssh2_org SUSE:OpenStack Cloud Crowbar 8 | All versions | 1.4.3-20.9.1 |
Products include Debian Debian Linux, Libssh2 Libssh2, Netapp Ontap Select Deploy Administration Utility, Opensuse Leap.
How do I fix CVE-2019-3860?
Upgrade to a fixed version.
Is CVE-2019-3860 being exploited?
There is no known exploitation of CVE-2019-3860 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2019-3860, DEBIAN-CVE-2019-3860, DLA-1730-4, GHSA-fq9v-3w7w-rvm2, SUSE-SU-2019:14098-1, SUSE-SU-2019:14099-1 and 3 more.