Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-3863: Old libssh2 clients can be crashed by bad SSH servers

CVE-2019-3863 · published 7 years ago

Summary

Versions of the libssh2 library earlier than 1.8.1, which many SSH client programs use, can be forced to write outside their memory when a server sends an excessively long keyboard‑interactive reply. This can cause the client program to crash or behave unpredictably. Upgrade libssh2 to version 1.8.1 or later, or apply the vendor’s security patch, to stop the issue.

What to do

Update canonical libssh2 to version 1.4.3-2ubuntu0.2+esm2.
Update canonical libssh2 to version 1.5.0-2ubuntu0.1+esm1.
Update debian libssh2 to version 1.8.0-2.1.
Update libssh2 libssh2 to version 1.8.1 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:Pro:14.04:LTS	canonical	libssh2	< 1.4.3-2ubuntu0.2+esm2 Fix: upgrade to 1.4.3-2ubuntu0.2+esm2
Ubuntu:Pro:16.04:LTS	canonical	libssh2	< 1.5.0-2ubuntu0.1+esm1 Fix: upgrade to 1.5.0-2ubuntu0.1+esm1
Ubuntu:Pro:18.04:LTS	canonical	libssh2	All versions
Debian:12	debian	libssh2	< 1.8.0-2.1 Fix: upgrade to 1.8.0-2.1
–	libssh2	libssh2	< 1.8.1 `cpe:2.3:a:libssh2:libssh2::::::::`
–	debian	debian_linux	8.0 `cpe:2.3:o:debian:debian_linux:8.0:::::::*`
–	netapp	ontap_select_deploy_administration_utility	All versions `cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:::::::*`
–	opensuse	leap	15.0 42.3 `cpe:2.3:o:opensuse:leap:15.0:::::::*`
–	redhat	enterprise_linux_desktop	7.0 `cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*`
–	redhat	enterprise_linux_server	7.0 `cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*`
–	redhat	enterprise_linux_server_aus	7.6 `cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:::::::*`
–	redhat	enterprise_linux_server_eus	7.6 `cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:::::::*`
–	redhat	enterprise_linux_server_tus	7.6 `cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:::::::*`
–	redhat	enterprise_linux_workstation	7.0 `cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*`
–	the libssh2 project	libssh2	1.8.1

Original advisory text

A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.

References

https://access.redhat.com/errata/RHSA-2019:1943 vendor-advisory x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3863 x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2019:0679 vendor-advisory x_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html vendor-advisory x_refsource_SUSE
https://www.debian.org/security/2019/dsa-4431 vendor-advisory x_refsource_DEBIAN
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html vendor-advisory x_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:1175 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:1652 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:1791 vendor-advisory x_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html mailing-list x_refsource_MLIST
https://security.netapp.com/advisory/ntap-20190327-0005/ x_refsource_CONFIRM
https://ubuntu.com/security/CVE-2019-3863 Third Party Advisory
https://github.com/libssh2/libssh2/pull/315 Third Party Advisory
https://ubuntu.com/security/notices/USN-5308-1 Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2019-3863 Third Party Advisory
https://www.libssh2.org/CVE-2019-3863.html x_refsource_MISC
https://security-tracker.debian.org/tracker/CVE-2019-3863 Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... vendor-advisory x_refsource_FEDORA
https://seclists.org/bugtraq/2019/Apr/25 mailing-list x_refsource_BUGTRAQ
https://access.redhat.com/errata/RHSA-2019:2399 vendor-advisory x_refsource_REDHAT
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html x_refsource_MISC

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

3% chance of attack within 30 days

Type

CWE-190Integer Overflow

CWE-787Out-of-bounds Write

Timeline

Published25 Mar 2019

Updated4 Nov 2026

First seen11 Apr 2026

Sources

CVE-2019-3863 · OSV

CVE-2019-3863 · NVD

UBUNTU-CVE-2019-3863 · OSV

DEBIAN-CVE-2019-3863 · OSV

CVE-2019-3863 · MITRE

Track software like this

Free during beta