USN-5308-1
- Source
- https://ubuntu.com/security/notices/USN-5308-1
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-5308-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/USN-5308-1
- Upstream
- Related
- Published
- 2022-03-07T23:47:01.471552Z
- Modified
- 2025-10-13T04:35:48Z
- Summary
- libssh2 vulnerabilities
- Details
-
It was discovered that libssh2 mishandled certain input. If libssh2 were used to connect to a malicious or compromised SSH server, a remote, unauthenticated attacker could possibly execute arbitrary code on the client system. (CVE-2019-3855)
It was discovered that libssh2 incorrectly handled prompt requests. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2019-3856)
It was discovered that libssh2 incorrectly handled SSHMSGCHANNEL_REQUEST packets. A remote attacker could possibly use this issue to execute arbitrary code, cause a denial of service, or obtain sensitive information. (CVE-2019-3857, CVE-2019-3862)
It was discovered that libssh2 incorrectly handled specially crafted SFTP packets. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3858)
It was discovered that libssh2 incorrectly handled certain specially crafted packets. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3859)
It was discovered that libssh2 incorrectly handled SFTP packets with empty payloads. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3860)
It was discovered that libssh2 incorrectly handled padding values in SSH packets. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3861)
It was discovered that libssh2 incorrectly handled interactive response messages length. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2019-3863)
It was discovered that libssh2 incorrectly handled the Diffie Hellman key exchange. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-13115)
It was discovered that libssh2 incorrectly handled bound checks in SSHMSGDISCONNECT. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-17498)
- References
-
- https://ubuntu.com/security/notices/USN-5308-1
- https://ubuntu.com/security/CVE-2019-3855
- https://ubuntu.com/security/CVE-2019-3856
- https://ubuntu.com/security/CVE-2019-3857
- https://ubuntu.com/security/CVE-2019-3858
- https://ubuntu.com/security/CVE-2019-3859
- https://ubuntu.com/security/CVE-2019-3860
- https://ubuntu.com/security/CVE-2019-3861
- https://ubuntu.com/security/CVE-2019-3862
- https://ubuntu.com/security/CVE-2019-3863
- https://ubuntu.com/security/CVE-2019-13115
- https://ubuntu.com/security/CVE-2019-17498
Affected packages
Ubuntu:Pro:16.04:LTS / libssh2
Package
- Name
- libssh2
- Purl
- pkg:deb/ubuntu/libssh2@1.5.0-2ubuntu0.1+esm1?arch=source&distro=esm-apps/xenial
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.5.0-2ubuntu0.1+esm1
Ecosystem specific
{
"binaries": [
{
"binary_version": "1.5.0-2ubuntu0.1+esm1",
"binary_name": "libssh2-1"
},
{
"binary_version": "1.5.0-2ubuntu0.1+esm1",
"binary_name": "libssh2-1-dev"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
Database specific
{
"cves_map": {
"cves": [
{
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2019-3855"
},
{
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2019-3856"
},
{
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2019-3857"
},
{
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2019-3858"
},
{
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2019-3859"
},
{
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2019-3860"
},
{
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2019-3861"
},
{
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2019-3862"
},
{
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2019-3863"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2019-13115"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2019-17498"
}
],
"ecosystem": "Ubuntu:Pro:16.04:LTS"
}
}