CVE-2019-3856
- State
- Published
- Severity
- 7.5 High
- Published
- Mar 25, 2019
- Updated
- Oct 14, 2026
- Reserved
- Jan 3, 2019
Description
An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 7.5 High | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | redhat |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
libssh2The libssh2 Project |
|
References
- https://www.libssh2.org/CVE-2019-3856.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3856
- [debian-lts-announce] 20190326 [SECURITY] [DLA 1730-1] libssh2 security updatemailing-list
- https://security.netapp.com/advisory/ntap-20190327-0005/
- RHSA-2019:0679vendor-advisory
- openSUSE-SU-2019:1075vendor-advisory
- openSUSE-SU-2019:1109vendor-advisory
- FEDORA-2019-3348cb4934vendor-advisory
- DSA-4431vendor-advisory
- 20190415 [SECURITY] [DSA 4431-1] libssh2 security updatemailing-list
- RHSA-2019:1175vendor-advisory
- RHSA-2019:1652vendor-advisory
- RHSA-2019:1791vendor-advisory
- RHSA-2019:1943vendor-advisory
- RHSA-2019:2399vendor-advisory
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.