Bug 1687310 (CVE-2019-3860)

Summary:	CVE-2019-3860 libssh2: Out-of-bounds reads with specially crafted SFTP packets
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bmcclain, dfediuck, djuran, eedri, erik-fedora, kdudka, mgoldboi, michal.skrivanek, mike, paul, rjones, rschiron, sbonazzo, security-response-team, sherold
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libssh2 1.8.1	Doc Type:	If docs needed, set a value
Doc Text:	An out of bounds read flaw was discovered in libssh2 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a denial of service or read data in the client memory.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-27 03:26:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1688443, 1688444, 1688445, 1690247, 1690248, 1690408, 1696058, 1697700
Bug Blocks:	1687317

Description Andrej Nemec 2019-03-11 08:58:36 UTC

A server could send a specially crafted partial SFTP packet with a empty payload
in response to various SFTP commands such as read directory, file status,
status vfs and symlink. The result would be a memory out of bounds read.

Comment 2 Andrej Nemec 2019-03-12 09:15:38 UTC

Acknowledgments:

Name: the libssh2 project
Upstream: Chris Coulson (Canonical Ltd.)

Comment 7 Doran Moppert 2019-03-19 04:41:38 UTC

Statement:

This flaw was present in libssh2 packages included in Red Hat Virtualization Hypervisor and Management Appliance, however libssh2 in these hosts is never exposed to malicious clients or servers.

Comment 8 Dhananjay Arunesh 2019-03-19 06:35:05 UTC

Reference:
https://www.openwall.com/lists/oss-security/2019/03/18/3

Upstream Patch:
https://libssh2.org/1.8.0-CVE/CVE-2019-3860.patch

Comment 9 Dhananjay Arunesh 2019-03-19 06:35:07 UTC

External References:

https://www.libssh2.org/CVE-2019-3860.html

Comment 10 Dhananjay Arunesh 2019-03-19 06:47:23 UTC

Created libssh tracking bugs for this issue:

Affects: fedora-all [bug 1690246]


Created mingw-libssh2 tracking bugs for this issue:

Affects: fedora-all [bug 1690247]

Comment 11 Dhananjay Arunesh 2019-03-19 06:48:53 UTC

Created mingw-libssh2 tracking bugs for this issue:

Affects: epel-7 [bug 1690248]

Comment 12 Andrej Nemec 2019-03-19 12:28:16 UTC

Created libssh2 tracking bugs for this issue:

Affects: fedora-all [bug 1690408]