Vulnerability Details : CVE-2019-17498
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.
Vulnerability category: OverflowDenial of service
Products affected by CVE-2019-17498
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
- cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
- cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-17498
0.23%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 61 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-17498
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:P |
8.6
|
4.9
|
NIST | |
|
8.1
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H |
2.8
|
5.2
|
NIST | |
|
8.1
|
HIGH | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H |
N/A
|
N/A
|
Oracle:CPUOct2023 |
CWE ids for CVE-2019-17498
-
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-17498
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22H4Q5XMGS3QNSA7OCL3U7UQZ4NXMR5O/
[SECURITY] Fedora 30 Update: libssh2-1.9.0-3.fc30 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html
[SECURITY] [DLA 2848-1] libssh2 security updateMailing List;Third Party Advisory
-
https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498
SecurityExploits/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498 at 8cbdbbe6363510f7d9ceec685373da12e6fc752d · kevinbackhouse/SecurityExploits · GitHubExploit;Third Party Advisory
-
https://security.netapp.com/advisory/ntap-20220909-0004/
CVE-2019-17498 Libssh2 Vulnerability in NetApp Products | NetApp Product SecurityThird Party Advisory
-
https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html
[SECURITY] [DLA 3559-1] libssh2 security update
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/
[SECURITY] Fedora 31 Update: libssh2-1.9.0-3.fc31 - package-announce - Fedora Mailing-ListsThird Party Advisory
-
https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9c
packet.c: improve message parsing (#402) · libssh2/libssh2@dedcbd1 · GitHubPatch;Third Party Advisory
-
https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480
libssh2/packet.c at 42d37aa63129a1b2644bf6495198923534322d64 · libssh2/libssh2 · GitHubExploit;Third Party Advisory
-
https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/
Another libssh2 integer overflow (CVE-2019-17498) | Semmle BlogBroken Link
-
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html
[security-announce] openSUSE-SU-2019:2483-1: moderate: Security update fMailing List;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2019/11/msg00010.html
[SECURITY] [DLA 1991-1] libssh2 security updateMailing List;Third Party Advisory
-
http://packetstormsecurity.com/files/172835/libssh2-1.9.0-Out-Of-Bounds-Read.html
libssh2 1.9.0 Out-Of-Bounds Read ≈ Packet Storm
Jump to