UBUNTU-CVE-2019-13115

    Dashboard / Vulnerabilities / UBUNTU-CVE-2019-13115

    UBUNTU-CVE-2019-13115

    Published: 16 Jul 2019Last Modified: 22 Apr 2026
    Upstream:
    CVE-2019-13115
    Aliases:
    USN-5308-1

    Summary:

    Details: In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.

    References: https://ubuntu.com/security/CVE-2019-13115, https://ubuntu.com/security/notices/USN-5308-1, https://www.cve.org/CVERecord?id=CVE-2019-13115

    Affected packages

    Package

    Name: libssh2

    Purl: pkg:deb/ubuntu/[email protected]+esm2?arch=source&distro=trusty/esm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.4.3-2ubuntu0.2+esm2

    Affected versions

    1.4.3-1
    1.4.3-2
    1.4.3-2ubuntu0.1
    1.4.3-2ubuntu0.2
    1.4.3-2ubuntu0.2+esm1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High