CVE-2019-3860
Public on 2019-03-25
Modified on 2025-11-21
Description
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 1 | libssh2 | 2023-06-06 | ALAS-2023-1756 | Fixed |
| Amazon Linux 2 - Core | libssh2 | 2023-05-16 | ALAS2-2023-2046 | Fixed |
| Amazon Linux 2023 | libssh2 | Not Affected |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H |