USN-5308-1: libssh2 Ubuntu

Vulnerability summary

USN-5308-1 is a vulnerability in libssh2 Ubuntu with no CVSS score yet.

Timeline

1. 07-03-2022
   PublishedVulnerability first disclosed.
2. 25-06-2026
   Last modifiedVulnerability information updated.

Description

libssh2 vulnerabilities It was discovered that libssh2 mishandled certain input. If libssh2 were used to connect to a malicious or compromised SSH server, a remote, unauthenticated attacker could possibly execute arbitrary code on the client system. (CVE-2019-3855) It was discovered that libssh2 incorrectly handled prompt requests. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2019-3856) It was discovered that libssh2 incorrectly handled SSH_MSG_CHANNEL_REQUEST packets. A remote attacker could possibly use this issue to execute arbitrary code, cause a denial of service, or obtain sensitive information. (CVE-2019-3857, CVE-2019-3862) It was discovered that libssh2 incorrectly handled specially crafted SFTP packets. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3858) It was discovered that libssh2 incorrectly handled certain specially crafted packets. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3859) It was discovered that libssh2 incorrectly handled SFTP packets with empty payloads. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3860) It was discovered that libssh2 incorrectly handled padding values in SSH packets. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3861) It was discovered that libssh2 incorrectly handled interactive response messages length. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2019-3863) It was discovered that libssh2 incorrectly handled the Diffie Hellman key exchange. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-13115) It was discovered that libssh2 incorrectly handled bound checks in SSH_MSG_DISCONNECT. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-17498)

No weakness data has been published for this record.