Skip to content

Commit a279393

Browse files
bagderbagder
committed
security fixes: landed in 1.8.1
1 parent e14eec8 commit a279393

20 files changed

+751
-2
lines changed

‎CVE-2019-3855.md

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
Possible integer overflow in transport read allows out-of-bounds write
2+
=======================================
3+
4+
Project libssh2 Security Advisory, March 14 2019 -
5+
[Permalink](https://www.libssh2.org/CVE-2019-3855.html)
6+
7+
VULNERABILITY
8+
-------------
9+
10+
A malicious server could send a specially crafted packet which could result in
11+
an unchecked integer overflow. The value would then be used to allocate memory
12+
causing a possible memory write out of bounds error (CWE-130).
13+
14+
There are no known exploits of this flaw at this time.
15+
16+
INFO
17+
----
18+
19+
The Common Vulnerabilities and Exposures (CVE) project has assigned the name
20+
CVE-2019-3855 to this issue.
21+
22+
AFFECTED VERSIONS
23+
-----------------
24+
25+
- Affected versions: all versions to and including 1.8.0
26+
- Not affected versions: libssh2 >= 1.8.1
27+
28+
THE SOLUTION
29+
------------
30+
31+
libssh2 1.8.1 ensures packet length value is below `LIBSSH2_PACKET_MAXPAYLOAD`
32+
(4000 bytes) before processing payload.
33+
34+
A patch for this problem is available at:
35+
36+
<patch URL>
37+
38+
RECOMMENDATIONS
39+
---------------
40+
41+
We suggest you take one of the following actions immediately, in order of
42+
preference:
43+
44+
A - Upgrade to libssh2 1.8.1 or later
45+
46+
B - Apply the patch and rebuild libssh2
47+
48+
TIME LINE
49+
---------
50+
51+
It was first reported to the libssh2 project on Dec 3 2018 by Chris Coulson.
52+
53+
libssh2 1.8.1 as released on March 14 2019, coordinated with the publication
54+
of this advisory.
55+
56+
CREDITS
57+
-------
58+
59+
Reported by Chris Coulson of Canonical Ltd.

‎CVE-2019-3855.t

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#include "doctype.t"
2+
#include "setup.t"
3+
HEAD(libssh2 Security Advisory: CVE-2019-3855)
4+
#include "body.t"
5+
#include "menu.t"
6+
7+
TITLE(libssh2 Security Advisory: CVE-2019-3855)
8+
BOXTOP
9+
10+
#include "CVE-2019-3855.gen"
11+
12+
BOXBOT
13+
14+
#include "footer.t"

‎CVE-2019-3856.md

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
Possible integer overflow in keyboard interactive handling allows out-of-bounds write
2+
=======================================
3+
4+
Project libssh2 Security Advisory, March 14 2019 -
5+
[Permalink](https://www.libssh2.org/CVE-2019-3856.html)
6+
7+
VULNERABILITY
8+
-------------
9+
10+
A server could send a value approching unsinged int max number of keyboard
11+
prompt requests which could result in an unchecked interger overflow. The value
12+
would then be used to allocate memory causing a possible memory write out of
13+
bounds error (CWE-130).
14+
15+
16+
There are no known exploits of this flaw at this time.
17+
18+
INFO
19+
----
20+
21+
The Common Vulnerabilities and Exposures (CVE) project has assigned the name
22+
CVE-2019-3856 to this issue.
23+
24+
AFFECTED VERSIONS
25+
-----------------
26+
27+
- Affected versions: all versions to and including 1.8.0
28+
- Not affected versions: libssh2 >= 1.8.1
29+
30+
THE SOLUTION
31+
------------
32+
33+
libssh2 1.9.0 ensures keyboard prompt requests value is less than 100 before
34+
proceeding with the login process.
35+
36+
37+
A patch for this problem is available at:
38+
39+
<patch URL>
40+
41+
RECOMMENDATIONS
42+
---------------
43+
44+
We suggest you take one of the following actions immediately, in order of
45+
preference:
46+
47+
A - Upgrade to libssh2 1.8.1 or later
48+
49+
B - Apply the patch and rebuild libssh2
50+
51+
TIME LINE
52+
---------
53+
54+
It was first reported to the libssh2 project on Dec 3 2018 by Chris Coulson.
55+
56+
libssh2 1.8.1 was released on <date>, coordinated with the
57+
publication of this advisory.
58+
59+
CREDITS
60+
-------
61+
62+
Reported by Chris Coulson of Canonical Ltd.

‎CVE-2019-3856.t

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#include "doctype.t"
2+
#include "setup.t"
3+
HEAD(libssh2 Security Advisory: CVE-2019-3856)
4+
#include "body.t"
5+
#include "menu.t"
6+
7+
TITLE(libssh2 Security Advisory: CVE-2019-3856)
8+
BOXTOP
9+
10+
#include "CVE-2019-3856.gen"
11+
12+
BOXBOT
13+
14+
#include "footer.t"

‎CVE-2019-3857.md

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
Possible integer overflow leading to zero-byte allocation and out-of-bounds write
2+
=================================================================================
3+
4+
Project libssh2 Security Advisory, March 14 2019 -
5+
[Permalink](https://www.libssh2.org/CVE-2019-3857.html)
6+
7+
VULNERABILITY
8+
-------------
9+
10+
A server could send a `SSH_MSG_CHANNEL_REQUEST` packet with an exit signal
11+
message with a length of max unsigned integer value. The length would then
12+
have a value of 1 added to it and used to allocate memory causing a possible
13+
memory write out of bounds error or zero byte allocation (CWE-130).
14+
15+
16+
There are no known exploits of this flaw at this time.
17+
18+
INFO
19+
----
20+
21+
The Common Vulnerabilities and Exposures (CVE) project has assigned the name
22+
CVE-2019-3857 to this issue.
23+
24+
AFFECTED VERSIONS
25+
-----------------
26+
27+
- Affected versions: versions 1.2.8 up to and including 1.8.0
28+
- Not affected versions: libssh2 >= 1.8.1
29+
30+
THE SOLUTION
31+
------------
32+
33+
libssh2 1.8.1 ensures the length of the message plus 1 is less than `UINT_MAX`
34+
before allocating memory using the computed value.
35+
36+
37+
A patch for this problem is available at:
38+
39+
<patch URL>
40+
41+
RECOMMENDATIONS
42+
---------------
43+
44+
We suggest you take one of the following actions immediately, in order of
45+
preference:
46+
47+
A - Upgrade to libssh2 1.8.1 or later
48+
49+
B - Apply the patch and rebuild libssh2
50+
51+
TIME LINE
52+
---------
53+
54+
It was first reported to the libssh2 project on Dec 3 2018 by Chris Coulson.
55+
56+
libssh2 1.8.1 was released on <date>, coordinated with the
57+
publication of this advisory.
58+
59+
CREDITS
60+
-------
61+
62+
Reported by Chris Coulson of Canonical Ltd.

‎CVE-2019-3857.t

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#include "doctype.t"
2+
#include "setup.t"
3+
HEAD(libssh2 Security Advisory: CVE-2019-3857)
4+
#include "body.t"
5+
#include "menu.t"
6+
7+
TITLE(libssh2 Security Advisory: CVE-2019-3857)
8+
BOXTOP
9+
10+
#include "CVE-2019-3857.gen"
11+
12+
BOXBOT
13+
14+
#include "footer.t"

‎CVE-2019-3858.md

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
Possible zero-byte allocation leading to an out-of-bounds read
2+
=======================================
3+
4+
Project libssh2 Security Advisory, March 14 2019 -
5+
[Permalink](https://www.libssh2.org/CVE-2019-3858.html)
6+
7+
VULNERABILITY
8+
-------------
9+
10+
A server could send a specially crafted partial SFTP packet with a zero value
11+
for the payload length. This zero value would be used to then allocate memory
12+
resulting in a zero byte allocation and possible out of bounds read (CWE-130).
13+
14+
15+
There are no known exploits of this flaw at this time.
16+
17+
INFO
18+
----
19+
20+
The Common Vulnerabilities and Exposures (CVE) project has assigned the name
21+
CVE-2019-3858 to this issue.
22+
23+
AFFECTED VERSIONS
24+
-----------------
25+
26+
- Affected versions: versions 0.3 up to and including 1.8.0
27+
- Not affected versions: libssh2 >= 1.8.1
28+
29+
THE SOLUTION
30+
------------
31+
32+
libssh2 1.9.0 ensures the length of the payload is not zero before allocing
33+
the memory buffer using the value.
34+
35+
36+
A patch for this problem is available at:
37+
38+
<patch URL>
39+
40+
RECOMMENDATIONS
41+
---------------
42+
43+
We suggest you take one of the following actions immediately, in order of
44+
preference:
45+
46+
A - Upgrade to libssh2 1.8.1 or later
47+
48+
B - Apply the patch and rebuild libssh2
49+
50+
TIME LINE
51+
---------
52+
53+
It was first reported to the libssh2 project on Dec 3 2018 by Chris Coulson.
54+
55+
libssh2 1.8.1 was released on March 14 2019, coordinated with the publication
56+
of this advisory.
57+
58+
CREDITS
59+
-------
60+
61+
Reported by Chris Coulson of Canonical Ltd.

‎CVE-2019-3858.t

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#include "doctype.t"
2+
#include "setup.t"
3+
HEAD(libssh2 Security Advisory: CVE-2019-3858)
4+
#include "body.t"
5+
#include "menu.t"
6+
7+
TITLE(libssh2 Security Advisory: CVE-2019-3858)
8+
BOXTOP
9+
10+
#include "CVE-2019-3858.gen"
11+
12+
BOXBOT
13+
14+
#include "footer.t"

‎CVE-2019-3859.md

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
Out-of-bounds reads with specially crafted payloads due to unchecked use of
2+
`_libssh2_packet_require` and `_libssh2_packet_requirev`
3+
=======================================
4+
5+
Project libssh2 Security Advisory, March 14 2019 -
6+
[Permalink](https://www.libssh2.org/CVE-2019-3859.html)
7+
8+
VULNERABILITY
9+
-------------
10+
11+
A server could send a specially crafted partial packet in response to various
12+
commands such as: sha1 and sha226 key exchange, user auth list, user auth
13+
password response, public key auth response, channel startup/open/forward/
14+
setenv/request pty/x11 and session start up. The result would be a memory out
15+
of bounds read (CWE-130).
16+
17+
There are no known exploits of this flaw at this time.
18+
19+
INFO
20+
----
21+
22+
The Common Vulnerabilities and Exposures (CVE) project has assigned the name
23+
CVE-2019-3859 to this issue.
24+
25+
AFFECTED VERSIONS
26+
-----------------
27+
28+
- Affected versions: versions 0.1 up to and including 1.8.0
29+
- Not affected versions: libssh2 >= 1.8.1
30+
31+
THE SOLUTION
32+
------------
33+
34+
libssh2 1.9.0 ensures the length of the payload is the required length before
35+
reading the packet buffer content.
36+
37+
38+
A patch for this problem is available at:
39+
40+
<patch URL>
41+
42+
RECOMMENDATIONS
43+
---------------
44+
45+
We suggest you take one of the following actions immediately, in order of
46+
preference:
47+
48+
A - Upgrade to libssh2 1.8.1 or greater
49+
50+
B - Apply the patch and rebuild libssh2
51+
52+
TIME LINE
53+
---------
54+
55+
It was first reported to the libssh2 project on Dec 3 2018 by Chris Coulson.
56+
57+
libssh2 1.8.1 was released on March 14 2019, coordinated with the publication
58+
of this advisory.
59+
60+
CREDITS
61+
-------
62+
63+
Reported by Chris Coulson of Canonical Ltd.

‎CVE-2019-3859.t

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#include "doctype.t"
2+
#include "setup.t"
3+
HEAD(libssh2 Security Advisory: CVE-2019-3859)
4+
#include "body.t"
5+
#include "menu.t"
6+
7+
TITLE(libssh2 Security Advisory: CVE-2019-3859)
8+
BOXTOP
9+
10+
#include "CVE-2019-3859.gen"
11+
12+
BOXBOT
13+
14+
#include "footer.t"

0 commit comments

Comments
 (0)