9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.046 Low
EPSS
Percentile
92.4%
libssh2 developers report:
Defend against possible integer overflows in comp_method_zlib_decomp.
Defend against writing beyond the end of the payload in _libssh2_transport_read().
Sanitize padding_length - _libssh2_transport_read().
This prevents an underflow resulting in a potential out-of-bounds read if a server sends a too-large padding_length, possibly with malicious intent.
Prevent zero-byte allocation in sftp_packet_read() which could lead to an out-of-bounds read.
Check the length of data passed to sftp_packet_add() to prevent out-of-bounds reads.
Add a required_size parameter to sftp_packet_require et. al. to require callers of these functions to handle packets that are too short.
Additional length checks to prevent out-of-bounds reads and writes in _libssh2_packet_add().
github.com/libssh2/libssh2/releases/tag/libssh2-1.8.1
libssh2.org/CVE-2019-3855.html
libssh2.org/CVE-2019-3856.html
libssh2.org/CVE-2019-3857.html
libssh2.org/CVE-2019-3858.html
libssh2.org/CVE-2019-3859.html
libssh2.org/CVE-2019-3860.html
libssh2.org/CVE-2019-3861.html
libssh2.org/CVE-2019-3862.html
libssh2.org/CVE-2019-3863.html
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.046 Low
EPSS
Percentile
92.4%