| Severity |
|
| Remote |
|
| Type |
| + |
Arbitrary code execution |
|
| Description |
| + |
An issue has been found in libssh2 before 1.8.1 where a server could send a SSH_MSG_CHANNEL_REQUEST packet with an exit signal message with a length of max unsigned integer value. The length would then have a value of 1 added to it and used to allocate memory causing a possible memory write out of bounds error or zero byte allocation. |
|
| References |
| + |
https://www.libssh2.org/CVE-2019-3857.html |
| + |
https://libssh2.org/1.8.0-CVE/CVE-2019-3857.patch |
|
| Notes |
|