CVE-2019-3860CWE-125

CVE-2019-3860

Medium · published March 25, 2019

CVSS v3.0
5.0
EPSS
5%
Percentile
92.7
In the wild
Unconfirmed
What it is

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

The record
Technical detail
CVSS v3.0
5.0 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.05424 · 92.7th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2019-03-25T23:29Z
Affected products (5)
ProductVersionsFixed in
libssh2/libssh2≥ 0.3, ≤ 1.8.0—
debian/debian_linuxall versions—
netapp/ontap_select_deploy_administration_utilityall versions—
opensuse/leapall versions—
opensuse/leapall versions—
References (25)
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00072.html · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3860 · [email protected]https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html · [email protected]https://lists.debian.org/debian-lts-announce/2019/07/msg00028.html · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/ · [email protected]https://seclists.org/bugtraq/2019/Apr/25 · [email protected]https://security.netapp.com/advisory/ntap-20190327-0005/ · [email protected]https://www.debian.org/security/2019/dsa-4431 · [email protected]https://www.libssh2.org/CVE-2019-3860.html · [email protected]https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00072.html · af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3860 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2019/07/msg00028.html · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/ · af854a3a-2127-422b-91ae-364da2661108https://seclists.org/bugtraq/2019/Apr/25 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20190327-0005/ · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2019/dsa-4431 · af854a3a-2127-422b-91ae-364da2661108https://www.libssh2.org/CVE-2019-3860.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 25 MAR 18:30Z
    An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed
    cvelistv5