High · published October 22, 2019
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.
| Product | Versions | Fixed in |
|---|---|---|
| libssh2/libssh2 | ≤ 1.9.0 | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| opensuse/leap | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| netapp/active_iq_unified_manager | all versions | — |
| netapp/element_software | all versions | — |
| netapp/hci_management_node | all versions | — |
| netapp/ontap_select_deploy_administration_utility | all versions | — |
| netapp/solidfire | all versions | — |
| netapp/bootstrap_os | all versions | — |