9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
10 High
AI Score
Confidence
High
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.046 Low
EPSS
Percentile
92.5%
It was discovered that libssh2 mishandled certain input. If libssh2 were
used to connect to a malicious or compromised SSH server, a remote,
unauthenticated attacker could possibly execute arbitrary code on the client
system. (CVE-2019-3855)
It was discovered that libssh2 incorrectly handled prompt requests. A
remote attacker could possibly use this issue to execute arbitrary code.
(CVE-2019-3856)
It was discovered that libssh2 incorrectly handled SSH_MSG_CHANNEL_REQUEST
packets. A remote attacker could possibly use this issue to execute
arbitrary code, cause a denial of service, or obtain sensitive information.
(CVE-2019-3857, CVE-2019-3862)
It was discovered that libssh2 incorrectly handled specially crafted SFTP
packets. A remote attacker could possibly use this issue to cause a denial
of service or obtain sensitive information. (CVE-2019-3858)
It was discovered that libssh2 incorrectly handled certain specially
crafted packets. A remote attacker could possibly use this issue to cause a
denial of service or obtain sensitive information. (CVE-2019-3859)
It was discovered that libssh2 incorrectly handled SFTP packets with empty
payloads. A remote attacker could possibly use this issue to cause a denial
of service or obtain sensitive information. (CVE-2019-3860)
It was discovered that libssh2 incorrectly handled padding values in SSH
packets. A remote attacker could possibly use this issue to cause a denial
of service or obtain sensitive information. (CVE-2019-3861)
It was discovered that libssh2 incorrectly handled interactive response
messages length. A remote attacker could possibly use this issue to execute
arbitrary code. (CVE-2019-3863)
It was discovered that libssh2 incorrectly handled the Diffie Hellman key
exchange. A remote attacker could possibly use this issue to cause a denial
of service or obtain sensitive information. (CVE-2019-13115)
It was discovered that libssh2 incorrectly handled bound checks in
SSH_MSG_DISCONNECT. A remote attacker could possibly use this issue to
cause a denial of service or obtain sensitive information. (CVE-2019-17498)
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Ubuntu | 16.04 | noarch | libssh2-1 | < 1.5.0-2ubuntu0.1+esm1 | UNKNOWN |
Ubuntu | 16.04 | noarch | libssh2-1 | < 1.5.0-2ubuntu0.1 | UNKNOWN |
Ubuntu | 16.04 | noarch | libssh2-1-dbg | < 1.5.0-2ubuntu0.1 | UNKNOWN |
Ubuntu | 16.04 | noarch | libssh2-1-dbgsym | < 1.5.0-2ubuntu0.1 | UNKNOWN |
Ubuntu | 16.04 | noarch | libssh2-1-dev | < 1.5.0-2ubuntu0.1 | UNKNOWN |
Ubuntu | 16.04 | noarch | libssh2-1-dev-dbgsym | < 1.5.0-2ubuntu0.1 | UNKNOWN |
ubuntu.com/security/CVE-2019-13115
ubuntu.com/security/CVE-2019-17498
ubuntu.com/security/CVE-2019-3855
ubuntu.com/security/CVE-2019-3856
ubuntu.com/security/CVE-2019-3857
ubuntu.com/security/CVE-2019-3858
ubuntu.com/security/CVE-2019-3859
ubuntu.com/security/CVE-2019-3860
ubuntu.com/security/CVE-2019-3861
ubuntu.com/security/CVE-2019-3862
ubuntu.com/security/CVE-2019-3863
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
10 High
AI Score
Confidence
High
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.046 Low
EPSS
Percentile
92.5%