CVE-2019-3862
moderate-risk
Published 2019-03-21
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
Do I need to act?
~
6.6% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.3/10
High
NETWORK
/ LOW complexity
Affected Products (5)
Affected Vendors
References (36)
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html
Third Party Advisory
http://www.securityfocus.com/bid/107485
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3862
Mailing List
https://seclists.org/bugtraq/2019/Mar/25
Third Party Advisory
https://security.netapp.com/advisory/ntap-20190327-0005/
Third Party Advisory
https://www.broadcom.com/support/fibre-channel-networking/security-advisories/br...
Vendor Advisory
https://www.libssh2.org/CVE-2019-3862.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html
and 16 more references
47
/ 100
moderate-risk
Severity
26/34 · High
Exploitability
9/34 · Low
Exposure
12/34 · Low