CVE-2019-3863

A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.

A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.

A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.

• SECURITY UPDATE: integer overflow in transport read allowing out-of-bounds write via crafted SSH packet
  • debian/patches/CVE-2019-3855.patch: add packet_length bounds check against LIBSSH2_PACKET_MAXPAYLOAD in transport read
  • CVE-2019-3855
• SECURITY UPDATE: integer overflow in keyboard-interactive handling allowing out-of-bounds write via crafted num-prompts value
  • debian/patches/CVE-2019-3856.patch: cap num_prompts at 100 to prevent excessive allocation in keyboard-interactive auth
  • CVE-2019-3856
• SECURITY UPDATE: integer overflow in keyboard-interactive response allowing out-of-bounds write via crafted response lengths
  • debian/patches/CVE-2019-3863.patch: add SIZE_MAX overflow check in keyboard-interactive response packet length calculation
  • CVE-2019-3863
• SECURITY UPDATE: out-of-bounds memory access in kex exchange when reading malformed data in diffie_hellman_sha1/sha256
  • debian/patches/CVE-2019-13115.patch: add _libssh2_copy_string() bounds-checked helper and use it in kex DH group exchange
  • CVE-2019-13115

Possible integer overflow in transport read allows out-of-bounds write. (CVE-2019-3855)

Possible integer overflow in keyboard interactive handling allows out-of-bounds write. (CVE-2019-3856)

Possible integer overflow leading to zero-byte allocation and out-of-bounds write. (CVE-2019-3857)

Possible zero-byte allocation leading to an out-of-bounds read. (CVE-2019-3858)

Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev. (CVE-2019-3859)

Out-of-bounds reads with specially crafted SFTP packets. (CVE-2019-3860)

Out-of-bounds reads with specially crafted SSH packets. (CVE-2019-3861)

Out-of-bounds memory comparison. (CVE-2019-3862)

Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes. (CVE-2019-3863)

This update for libssh2_org fixes the following issues:

Security issues fixed:

• CVE-2019-3861: Fixed Out-of-bounds reads with specially crafted SSH packets (bsc#1128490).
• CVE-2019-3862: Fixed Out-of-bounds memory comparison with specially crafted message channel request packet (bsc#1128492).
• CVE-2019-3860: Fixed Out-of-bounds reads with specially crafted SFTP packets (bsc#1128481).
• CVE-2019-3863: Fixed an Integer overflow in user authenicate keyboard interactive which could allow out-of-bounds writes with specially crafted keyboard responses (bsc#1128493).
• CVE-2019-3856: Fixed a potential Integer overflow in keyboard interactive handling which could allow out-of-bounds write with specially crafted payload (bsc#1128472).
• CVE-2019-3859: Fixed Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev (bsc#1128480).
• CVE-2019-3855: Fixed a potential Integer overflow in transport read which could allow out-of-bounds write with specially crafted payload (bsc#1128471).
• CVE-2019-3858: Fixed a potential zero-byte allocation which could lead to an out-of-bounds read with a specially crafted SFTP packet (bsc#1128476).
• CVE-2019-3857: Fixed a potential Integer overflow which could lead to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet (bsc#1128474).

This update was imported from the SUSE:SLE-15:Update update project.

This update for libssh2_org fixes the following issues:

• Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes:

  • adds ECDSA keys and host key support when using OpenSSL
  • adds ED25519 key and host key support when using OpenSSL 1.1.1
  • adds OpenSSH style key file reading
  • adds AES CTR mode support when using WinCNG
  • adds PEM passphrase protected file support for Libgcrypt and WinCNG
  • adds SHA256 hostkey fingerprint
  • adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path()
  • adds explicit zeroing of sensitive data in memory
  • adds additional bounds checks to network buffer reads
  • adds the ability to use the server default permissions when creating sftp directories
  • adds support for building with OpenSSL no engine flag
  • adds support for building with LibreSSL
  • increased sftp packet size to 256k
  • fixed oversized packet handling in sftp
  • fixed building with OpenSSL 1.1
  • fixed a possible crash if sftp stat gets an unexpected response
  • fixed incorrect parsing of the KEX preference string value
  • fixed conditional RSA and AES-CTR support
  • fixed a small memory leak during the key exchange process
  • fixed a possible memory leak of the ssh banner string
  • fixed various small memory leaks in the backends
  • fixed possible out of bounds read when parsing public keys from the server
  • fixed possible out of bounds read when parsing invalid PEM files
  • no longer null terminates the scp remote exec command
  • now handle errors when diffie hellman key pair generation fails
  • improved building instructions
  • improved unit tests

• Version update to 1.8.2: [bsc#1130103] Bug fixes:

  • Fixed the misapplied userauth patch that broke 1.8.1
  • moved the MAX size declarations from the public header This update was imported from the SUSE:SLE-15:Update update project.

This update for libssh2_org fixes the following issues:

• Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes:

  • adds ECDSA keys and host key support when using OpenSSL
  • adds ED25519 key and host key support when using OpenSSL 1.1.1
  • adds OpenSSH style key file reading
  • adds AES CTR mode support when using WinCNG
  • adds PEM passphrase protected file support for Libgcrypt and WinCNG
  • adds SHA256 hostkey fingerprint
  • adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path()
  • adds explicit zeroing of sensitive data in memory
  • adds additional bounds checks to network buffer reads
  • adds the ability to use the server default permissions when creating sftp directories
  • adds support for building with OpenSSL no engine flag
  • adds support for building with LibreSSL
  • increased sftp packet size to 256k
  • fixed oversized packet handling in sftp
  • fixed building with OpenSSL 1.1
  • fixed a possible crash if sftp stat gets an unexpected response
  • fixed incorrect parsing of the KEX preference string value
  • fixed conditional RSA and AES-CTR support
  • fixed a small memory leak during the key exchange process
  • fixed a possible memory leak of the ssh banner string
  • fixed various small memory leaks in the backends
  • fixed possible out of bounds read when parsing public keys from the server
  • fixed possible out of bounds read when parsing invalid PEM files
  • no longer null terminates the scp remote exec command
  • now handle errors when diffie hellman key pair generation fails
  • improved building instructions
  • improved unit tests

• Version update to 1.8.2: [bsc#1130103] Bug fixes:

  • Fixed the misapplied userauth patch that broke 1.8.1
  • moved the MAX size declarations from the public header This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the libssh2-1-1.9.0-3.6 package on the GA media of openSUSE Tumbleweed.

This update for libssh2_org fixes the following issues:

Security issues fixed:

• CVE-2019-3861: Fixed Out-of-bounds reads with specially crafted SSH packets (bsc#1128490).
• CVE-2019-3862: Fixed Out-of-bounds memory comparison with specially crafted message channel request packet (bsc#1128492).
• CVE-2019-3860: Fixed Out-of-bounds reads with specially crafted SFTP packets (bsc#1128481).
• CVE-2019-3863: Fixed an Integer overflow in user authenticate keyboard interactive which could allow out-of-bounds writes with specially crafted keyboard responses (bsc#1128493).
• CVE-2019-3856: Fixed a potential Integer overflow in keyboard interactive handling which could allow out-of-bounds write with specially crafted payload (bsc#1128472).
• CVE-2019-3859: Fixed Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev (bsc#1128480).
• CVE-2019-3855: Fixed a potential Integer overflow in transport read which could allow out-of-bounds write with specially crafted payload (bsc#1128471).
• CVE-2019-3858: Fixed a potential zero-byte allocation which could lead to an out-of-bounds read with a specially crafted SFTP packet (bsc#1128476).
• CVE-2019-3857: Fixed a potential Integer overflow which could lead to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet (bsc#1128474).

Other issue addressed:

• Libbssh2 will stop using keys unsupported types in the known_hosts file (bsc#1091236).

This update for libssh2_org fixes the following issues:

Security issues fixed:

• CVE-2019-3861: Fixed Out-of-bounds reads with specially crafted SSH packets (bsc#1128490).
• CVE-2019-3862: Fixed Out-of-bounds memory comparison with specially crafted message channel request packet (bsc#1128492).
• CVE-2019-3860: Fixed Out-of-bounds reads with specially crafted SFTP packets (bsc#1128481).
• CVE-2019-3863: Fixed an Integer overflow in user authenicate keyboard interactive which could allow out-of-bounds writes with specially crafted keyboard responses (bsc#1128493).
• CVE-2019-3856: Fixed a potential Integer overflow in keyboard interactive handling which could allow out-of-bounds write with specially crafted payload (bsc#1128472).
• CVE-2019-3859: Fixed Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev (bsc#1128480).
• CVE-2019-3855: Fixed a potential Integer overflow in transport read which could allow out-of-bounds write with specially crafted payload (bsc#1128471).
• CVE-2019-3858: Fixed a potential zero-byte allocation which could lead to an out-of-bounds read with a specially crafted SFTP packet (bsc#1128476).
• CVE-2019-3857: Fixed a potential Integer overflow which could lead to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet (bsc#1128474).

This update for libssh2_org fixes the following issues:

Security issues fixed:

• CVE-2019-3861: Fixed Out-of-bounds reads with specially crafted SSH packets (bsc#1128490).
• CVE-2019-3862: Fixed Out-of-bounds memory comparison with specially crafted message channel request packet (bsc#1128492).
• CVE-2019-3860: Fixed Out-of-bounds reads with specially crafted SFTP packets (bsc#1128481).
• CVE-2019-3863: Fixed an Integer overflow in user authenticate keyboard interactive which could allow out-of-bounds writes with specially crafted keyboard responses (bsc#1128493).
• CVE-2019-3856: Fixed a potential Integer overflow in keyboard interactive handling which could allow out-of-bounds write with specially crafted payload (bsc#1128472).
• CVE-2019-3859: Fixed Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev (bsc#1128480).
• CVE-2019-3855: Fixed a potential Integer overflow in transport read which could allow out-of-bounds write with specially crafted payload (bsc#1128471).
• CVE-2019-3858: Fixed a potential zero-byte allocation which could lead to an out-of-bounds read with a specially crafted SFTP packet (bsc#1128476).
• CVE-2019-3857: Fixed a potential Integer overflow which could lead to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet (bsc#1128474).

Other issue addressed:

• Fixed an issue where libssh2 stops parsing known_hosts (bsc#1091236).

This update for libssh2_org fixes the following issues:

• Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes:

  • adds ECDSA keys and host key support when using OpenSSL
  • adds ED25519 key and host key support when using OpenSSL 1.1.1
  • adds OpenSSH style key file reading
  • adds AES CTR mode support when using WinCNG
  • adds PEM passphrase protected file support for Libgcrypt and WinCNG
  • adds SHA256 hostkey fingerprint
  • adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path()
  • adds explicit zeroing of sensitive data in memory
  • adds additional bounds checks to network buffer reads
  • adds the ability to use the server default permissions when creating sftp directories
  • adds support for building with OpenSSL no engine flag
  • adds support for building with LibreSSL
  • increased sftp packet size to 256k
  • fixed oversized packet handling in sftp
  • fixed building with OpenSSL 1.1
  • fixed a possible crash if sftp stat gets an unexpected response
  • fixed incorrect parsing of the KEX preference string value
  • fixed conditional RSA and AES-CTR support
  • fixed a small memory leak during the key exchange process
  • fixed a possible memory leak of the ssh banner string
  • fixed various small memory leaks in the backends
  • fixed possible out of bounds read when parsing public keys from the server
  • fixed possible out of bounds read when parsing invalid PEM files
  • no longer null terminates the scp remote exec command
  • now handle errors when diffie hellman key pair generation fails
  • improved building instructions
  • improved unit tests

• Version update to 1.8.2: [bsc#1130103] Bug fixes:

  • Fixed the misapplied userauth patch that broke 1.8.1
  • moved the MAX size declarations from the public header

It was discovered that libssh2 mishandled certain input. If libssh2 were used to connect to a malicious or compromised SSH server, a remote, unauthenticated attacker could possibly execute arbitrary code on the client system. (CVE-2019-3855)

It was discovered that libssh2 incorrectly handled prompt requests. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2019-3856)

It was discovered that libssh2 incorrectly handled SSH_MSG_CHANNEL_REQUEST packets. A remote attacker could possibly use this issue to execute arbitrary code, cause a denial of service, or obtain sensitive information. (CVE-2019-3857, CVE-2019-3862)

It was discovered that libssh2 incorrectly handled specially crafted SFTP packets. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3858)

It was discovered that libssh2 incorrectly handled certain specially crafted packets. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3859)

It was discovered that libssh2 incorrectly handled SFTP packets with empty payloads. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3860)

It was discovered that libssh2 incorrectly handled padding values in SSH packets. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3861)

It was discovered that libssh2 incorrectly handled interactive response messages length. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2019-3863)

It was discovered that libssh2 incorrectly handled the Diffie Hellman key exchange. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-13115)

It was discovered that libssh2 incorrectly handled bound checks in SSH_MSG_DISCONNECT. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-17498)