CVE-2019-3857

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

• SECURITY UPDATE: Integer overflow leading to out-of-bounds write when SSH_MSG_CHANNEL_REQUEST packets with exit signal messages are parsed.
  • debian/patches/CVE-2019-3857.patch: check namelen + 1 does not overflow before allocation in exit-signal handling.
  • CVE-2019-3857
• SECURITY UPDATE: Integer overflow in bounds check in SSH_MSG_DISCONNECT packet parsing enabling out-of-bounds read.
  • debian/patches/CVE-2019-17498.patch: harden bounds checking in SSH_MSG_DISCONNECT, SSH_MSG_DEBUG, and SSH_MSG_GLOBAL_REQUEST handlers to prevent unsigned integer underflow and overflow.
  • CVE-2019-17498

Possible integer overflow in transport read allows out-of-bounds write. (CVE-2019-3855)

Possible integer overflow in keyboard interactive handling allows out-of-bounds write. (CVE-2019-3856)

Possible integer overflow leading to zero-byte allocation and out-of-bounds write. (CVE-2019-3857)

Possible zero-byte allocation leading to an out-of-bounds read. (CVE-2019-3858)

Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev. (CVE-2019-3859)

Out-of-bounds reads with specially crafted SFTP packets. (CVE-2019-3860)

Out-of-bounds reads with specially crafted SSH packets. (CVE-2019-3861)

Out-of-bounds memory comparison. (CVE-2019-3862)

Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes. (CVE-2019-3863)

This update for libssh2_org fixes the following issues:

Security issues fixed:

• CVE-2019-3861: Fixed Out-of-bounds reads with specially crafted SSH packets (bsc#1128490).
• CVE-2019-3862: Fixed Out-of-bounds memory comparison with specially crafted message channel request packet (bsc#1128492).
• CVE-2019-3860: Fixed Out-of-bounds reads with specially crafted SFTP packets (bsc#1128481).
• CVE-2019-3863: Fixed an Integer overflow in user authenicate keyboard interactive which could allow out-of-bounds writes with specially crafted keyboard responses (bsc#1128493).
• CVE-2019-3856: Fixed a potential Integer overflow in keyboard interactive handling which could allow out-of-bounds write with specially crafted payload (bsc#1128472).
• CVE-2019-3859: Fixed Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev (bsc#1128480).
• CVE-2019-3855: Fixed a potential Integer overflow in transport read which could allow out-of-bounds write with specially crafted payload (bsc#1128471).
• CVE-2019-3858: Fixed a potential zero-byte allocation which could lead to an out-of-bounds read with a specially crafted SFTP packet (bsc#1128476).
• CVE-2019-3857: Fixed a potential Integer overflow which could lead to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet (bsc#1128474).

This update was imported from the SUSE:SLE-15:Update update project.

This update for libssh2_org fixes the following issues:

• Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes:

  • adds ECDSA keys and host key support when using OpenSSL
  • adds ED25519 key and host key support when using OpenSSL 1.1.1
  • adds OpenSSH style key file reading
  • adds AES CTR mode support when using WinCNG
  • adds PEM passphrase protected file support for Libgcrypt and WinCNG
  • adds SHA256 hostkey fingerprint
  • adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path()
  • adds explicit zeroing of sensitive data in memory
  • adds additional bounds checks to network buffer reads
  • adds the ability to use the server default permissions when creating sftp directories
  • adds support for building with OpenSSL no engine flag
  • adds support for building with LibreSSL
  • increased sftp packet size to 256k
  • fixed oversized packet handling in sftp
  • fixed building with OpenSSL 1.1
  • fixed a possible crash if sftp stat gets an unexpected response
  • fixed incorrect parsing of the KEX preference string value
  • fixed conditional RSA and AES-CTR support
  • fixed a small memory leak during the key exchange process
  • fixed a possible memory leak of the ssh banner string
  • fixed various small memory leaks in the backends
  • fixed possible out of bounds read when parsing public keys from the server
  • fixed possible out of bounds read when parsing invalid PEM files
  • no longer null terminates the scp remote exec command
  • now handle errors when diffie hellman key pair generation fails
  • improved building instructions
  • improved unit tests

• Version update to 1.8.2: [bsc#1130103] Bug fixes:

  • Fixed the misapplied userauth patch that broke 1.8.1
  • moved the MAX size declarations from the public header This update was imported from the SUSE:SLE-15:Update update project.

This update for libssh2_org fixes the following issues:

• Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes:

  • adds ECDSA keys and host key support when using OpenSSL
  • adds ED25519 key and host key support when using OpenSSL 1.1.1
  • adds OpenSSH style key file reading
  • adds AES CTR mode support when using WinCNG
  • adds PEM passphrase protected file support for Libgcrypt and WinCNG
  • adds SHA256 hostkey fingerprint
  • adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path()
  • adds explicit zeroing of sensitive data in memory
  • adds additional bounds checks to network buffer reads
  • adds the ability to use the server default permissions when creating sftp directories
  • adds support for building with OpenSSL no engine flag
  • adds support for building with LibreSSL
  • increased sftp packet size to 256k
  • fixed oversized packet handling in sftp
  • fixed building with OpenSSL 1.1
  • fixed a possible crash if sftp stat gets an unexpected response
  • fixed incorrect parsing of the KEX preference string value
  • fixed conditional RSA and AES-CTR support
  • fixed a small memory leak during the key exchange process
  • fixed a possible memory leak of the ssh banner string
  • fixed various small memory leaks in the backends
  • fixed possible out of bounds read when parsing public keys from the server
  • fixed possible out of bounds read when parsing invalid PEM files
  • no longer null terminates the scp remote exec command
  • now handle errors when diffie hellman key pair generation fails
  • improved building instructions
  • improved unit tests

• Version update to 1.8.2: [bsc#1130103] Bug fixes:

  • Fixed the misapplied userauth patch that broke 1.8.1
  • moved the MAX size declarations from the public header This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the libssh2-1-1.9.0-3.6 package on the GA media of openSUSE Tumbleweed.

This update for libssh2_org fixes the following issues:

Security issues fixed:

• CVE-2019-3861: Fixed Out-of-bounds reads with specially crafted SSH packets (bsc#1128490).
• CVE-2019-3862: Fixed Out-of-bounds memory comparison with specially crafted message channel request packet (bsc#1128492).
• CVE-2019-3860: Fixed Out-of-bounds reads with specially crafted SFTP packets (bsc#1128481).
• CVE-2019-3863: Fixed an Integer overflow in user authenticate keyboard interactive which could allow out-of-bounds writes with specially crafted keyboard responses (bsc#1128493).
• CVE-2019-3856: Fixed a potential Integer overflow in keyboard interactive handling which could allow out-of-bounds write with specially crafted payload (bsc#1128472).
• CVE-2019-3859: Fixed Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev (bsc#1128480).
• CVE-2019-3855: Fixed a potential Integer overflow in transport read which could allow out-of-bounds write with specially crafted payload (bsc#1128471).
• CVE-2019-3858: Fixed a potential zero-byte allocation which could lead to an out-of-bounds read with a specially crafted SFTP packet (bsc#1128476).
• CVE-2019-3857: Fixed a potential Integer overflow which could lead to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet (bsc#1128474).

Other issue addressed:

• Libbssh2 will stop using keys unsupported types in the known_hosts file (bsc#1091236).

This update for libssh2_org fixes the following issues:

Security issues fixed:

• CVE-2019-3861: Fixed Out-of-bounds reads with specially crafted SSH packets (bsc#1128490).
• CVE-2019-3862: Fixed Out-of-bounds memory comparison with specially crafted message channel request packet (bsc#1128492).
• CVE-2019-3860: Fixed Out-of-bounds reads with specially crafted SFTP packets (bsc#1128481).
• CVE-2019-3863: Fixed an Integer overflow in user authenicate keyboard interactive which could allow out-of-bounds writes with specially crafted keyboard responses (bsc#1128493).
• CVE-2019-3856: Fixed a potential Integer overflow in keyboard interactive handling which could allow out-of-bounds write with specially crafted payload (bsc#1128472).
• CVE-2019-3859: Fixed Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev (bsc#1128480).
• CVE-2019-3855: Fixed a potential Integer overflow in transport read which could allow out-of-bounds write with specially crafted payload (bsc#1128471).
• CVE-2019-3858: Fixed a potential zero-byte allocation which could lead to an out-of-bounds read with a specially crafted SFTP packet (bsc#1128476).
• CVE-2019-3857: Fixed a potential Integer overflow which could lead to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet (bsc#1128474).

This update for libssh2_org fixes the following issues:

Security issues fixed:

• CVE-2019-3861: Fixed Out-of-bounds reads with specially crafted SSH packets (bsc#1128490).
• CVE-2019-3862: Fixed Out-of-bounds memory comparison with specially crafted message channel request packet (bsc#1128492).
• CVE-2019-3860: Fixed Out-of-bounds reads with specially crafted SFTP packets (bsc#1128481).
• CVE-2019-3863: Fixed an Integer overflow in user authenticate keyboard interactive which could allow out-of-bounds writes with specially crafted keyboard responses (bsc#1128493).
• CVE-2019-3856: Fixed a potential Integer overflow in keyboard interactive handling which could allow out-of-bounds write with specially crafted payload (bsc#1128472).
• CVE-2019-3859: Fixed Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev (bsc#1128480).
• CVE-2019-3855: Fixed a potential Integer overflow in transport read which could allow out-of-bounds write with specially crafted payload (bsc#1128471).
• CVE-2019-3858: Fixed a potential zero-byte allocation which could lead to an out-of-bounds read with a specially crafted SFTP packet (bsc#1128476).
• CVE-2019-3857: Fixed a potential Integer overflow which could lead to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet (bsc#1128474).

Other issue addressed:

• Fixed an issue where libssh2 stops parsing known_hosts (bsc#1091236).

This update for libssh2_org fixes the following issues:

• Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes:

  • adds ECDSA keys and host key support when using OpenSSL
  • adds ED25519 key and host key support when using OpenSSL 1.1.1
  • adds OpenSSH style key file reading
  • adds AES CTR mode support when using WinCNG
  • adds PEM passphrase protected file support for Libgcrypt and WinCNG
  • adds SHA256 hostkey fingerprint
  • adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path()
  • adds explicit zeroing of sensitive data in memory
  • adds additional bounds checks to network buffer reads
  • adds the ability to use the server default permissions when creating sftp directories
  • adds support for building with OpenSSL no engine flag
  • adds support for building with LibreSSL
  • increased sftp packet size to 256k
  • fixed oversized packet handling in sftp
  • fixed building with OpenSSL 1.1
  • fixed a possible crash if sftp stat gets an unexpected response
  • fixed incorrect parsing of the KEX preference string value
  • fixed conditional RSA and AES-CTR support
  • fixed a small memory leak during the key exchange process
  • fixed a possible memory leak of the ssh banner string
  • fixed various small memory leaks in the backends
  • fixed possible out of bounds read when parsing public keys from the server
  • fixed possible out of bounds read when parsing invalid PEM files
  • no longer null terminates the scp remote exec command
  • now handle errors when diffie hellman key pair generation fails
  • improved building instructions
  • improved unit tests

• Version update to 1.8.2: [bsc#1130103] Bug fixes:

  • Fixed the misapplied userauth patch that broke 1.8.1
  • moved the MAX size declarations from the public header

It was discovered that libssh2 mishandled certain input. If libssh2 were used to connect to a malicious or compromised SSH server, a remote, unauthenticated attacker could possibly execute arbitrary code on the client system. (CVE-2019-3855)

It was discovered that libssh2 incorrectly handled prompt requests. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2019-3856)

It was discovered that libssh2 incorrectly handled SSH_MSG_CHANNEL_REQUEST packets. A remote attacker could possibly use this issue to execute arbitrary code, cause a denial of service, or obtain sensitive information. (CVE-2019-3857, CVE-2019-3862)

It was discovered that libssh2 incorrectly handled specially crafted SFTP packets. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3858)

It was discovered that libssh2 incorrectly handled certain specially crafted packets. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3859)

It was discovered that libssh2 incorrectly handled SFTP packets with empty payloads. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3860)

It was discovered that libssh2 incorrectly handled padding values in SSH packets. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3861)

It was discovered that libssh2 incorrectly handled interactive response messages length. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2019-3863)

It was discovered that libssh2 incorrectly handled the Diffie Hellman key exchange. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-13115)

It was discovered that libssh2 incorrectly handled bound checks in SSH_MSG_DISCONNECT. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-17498)