Bug 2376193 (CVE-2025-4877)

Summary: CVE-2025-4877 libssh: Write beyond bounds in binary to base64 conversion functions
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: adudiak, kshier, omaciel, stcannon, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can experience an integer overflow leading to a memory under allocation, when that happens it's possible that the program perform out of bounds write leading to a heap corruption. This issue affects only 32-bits builds of libssh.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-07-03 19:28:37 UTC 
bin_to_base64() (src/base64.c) can experience an integer overflow and subsequent under allocation, leading to a write beyond bounds. The bug can occur only in 32-bit builds. The only problematic use case is ssh_get_fingerprint_hash() in case the API is (mis)used and a libssh consumer passes in an unexpectedly large input buffer. As a mitigation, the function bin_to_base64() is adjusted to not allow inputs larger than 256MB, which is aligned with other functions that process user input.