CVE-2019-3858

CRITICAL 9.1CVE-2019-3858 · Published 21/03/2019 · updated 14/10/2026

Package	Affected versions	Patched versions
libssh2 libssh2	`< 1.8.1`	`1.8.1`

Description

An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

References

lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html · Third Party Advisory
packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html · Third Party Advisory
openwall.com/lists/oss-security/2019/03/18/3 · Mailing List
securityfocus.com/bid/107485 · Third Party Advisory
access.redhat.com/errata/RHSA-2019:2136
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
lists.debian.org/debian-lts-announce/2019/03/msg00032.html · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO
seclists.org/bugtraq/2019/Apr/25
seclists.org/bugtraq/2019/Mar/25 · Mailing List
security.netapp.com/advisory/ntap-20190327-0005 · Third Party Advisory
broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767 · Third Party Advisory
debian.org/security/2019/dsa-4431
libssh2.org/CVE-2019-3858.html · Patch
oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
cert-portal.siemens.com/productcert/html/ssa-398330.html

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free